@sophieschmieg @filippo @soatok each FTQC will be very expensive; looking at the time estimates, each broken key is weeks of time on a state-scale computer. This is worth considering in a threat model (but costs will come down and the speed up to larger FTQCs appear to be greater than linear)