Douglas B. Books
Before Q-Day · read online

Part Two — Where Each Chain Stands

Stage 1 — the full colour nebula

Stage 1 — the full colour nebula. Art by Douglas John Brownfield.

Chapter 7 — The Ones Who Already Crossed

Before judging the chains for slowness, look at the industries that have already done this — because they show both that the crossing is possible and which half of it is hard.

Messaging went first. Signal — whose protocol also underlies WhatsApp — added post-quantum key agreement in September 2023 (PQXDH: the classical X25519 exchange and Kyber-1024, run together, so an attacker must break both), and followed in October 2025 with a full post-quantum ratchet (SPQR), so the protection renews with every message, not just the first. Apple announced iMessage PQ3 in February 2024 and shipped it that spring: hybrid key establishment plus periodic post-quantum rekeying — a design Apple rated above every other deployed messaging protocol. The tools you already use crossed too: OpenSSH has defaulted to a post-quantum hybrid key exchange since version 9.0 in April 2022 (and to the ML-KEM hybrid since 10.0 in 2025); Chrome turned on hybrid post-quantum key exchange in 2023 and standardised it in November 2024; Cloudflare has offered it since October 2022, and by late October 2025 more than half of all human-initiated traffic across Cloudflare's network was already post-quantum protected. OpenSSL, Go, and Firefox carry the same default. You have probably used post-quantum cryptography today. You just weren't told, which is what a finished migration looks like.

Now the nuance this book exists to carry: almost everything above is key exchange, not signatures. Those systems migrated the confidentiality half — agreeing keys a quantum computer can't later unwrap. The authenticity half — signatures — lags everywhere: OpenSSH states plainly that post-quantum signatures are not yet supported; Signal's and Apple's user authentication remains classical. The world has crossed the river you can cross with KEMs. The signature crossing — the one your wallet needs — has been completed at scale by no one. The chains in this part are not behind the world on the hard half. The world is with them, unfinished, on the same half.

Chapter 8 — Bitcoin — Drafts, Not Decisions

Bitcoin's post-quantum state, as of November 2026, fits in one paragraph — and then deserves three pages of context, because the paragraph is easy to misread as inaction.

Nothing is activated. No post-quantum scheme is chosen. What exists is drafts. BIP-360 (merged as a draft in February 2026) proposes P2MR — essentially Taproot with the key-path spend removed, so no public key sits exposed in the output. It contains no post-quantum signature at all; it is groundwork, not the crossing. BIP-361 (April 2026) proposes the hard part as policy: some years after a post-quantum address type activates, stop deposits to quantum-vulnerable types, and some years after that, make coins in them unspendable by the old signatures — with a zero-knowledge proof-of-seed path by which a living owner could still recover. Its lead author, Jameson Lopp, argues the case bluntly: coins recovered by a quantum attacker "only make everyone else's coins worth less — think of it as a theft from everyone." A third draft family, SHRINCS, works on shrinking hash-based signatures toward practicality (a 48-byte public key; signatures from a few hundred bytes upward, depending on the version of the draft you read — its reviewers note the security proof is still a TODO). And in January 2026 a company launched a public test network implementing BIP-360 with ML-DSA signatures, so the mechanics can be exercised even while the proposals are undecided.

Context, then. The unresolved question is not the cryptography — several buildable candidates exist. It is the question of Chapter 6's third-of-the-supply: what does the network do about coins whose owners never move them — the lost, the dead, and the patient, including the creator's own million? Freeze them by consensus, and Bitcoin breaks a promise it has kept since 2009 (that valid coins remain spendable). Leave them, and the first cryptographically relevant quantum computer inherits them. That is a genuinely hard question wearing a technical costume, and it is being argued in the open, in drafts, by named people — which is where Bitcoin makes all its hard decisions. The counter-arguments get their own full hearing in Chapter 22. For the map, the state is: the debate is the work, and the debate is underway.

Chapter 9 — A Short History of Bitcoin

Twelve dates carry the holder's version of the story — and notice, as you read, that it is mostly a history of addresses and signatures:

Electronic Cash System," posted by Satoshi Nakamoto.

newspaper headline: "The Times 03/Jan/2009 Chancellor on brink of second bailout for banks." Its output is P2PK — the raw public key, exposed from day one. ECDSA signs everything.

Finney, 10 BTC.

"1…" form. Keys hidden until spent. (Chapter 14's rule is born here.)

pizzas.

One seed, many keys.

24-word phrases every holder now knows.

addresses. Still ECDSA.

change of signature scheme in Bitcoin's history — Schnorr signatures for P2TR outputs, "bc1p" — and, per Chapter 14, keys visible at rest.

Seventeen years, three address eras, one signature change. The next change of signature scheme — the post-quantum one — will be the second in the system's life, and the first that holders didn't choose one wallet at a time, but must complete against a deadline set outside the system entirely.

Chapter 10 — Ethereum — The Account Route

Ethereum's problem is shaped differently, and so is its answer. An Ethereum account's public key is revealed by its first outgoing transaction — which is to say, essentially every active account has already revealed it. There is no hash hiding to preserve, and Chapter 6 recorded that nobody has even published the aggregate count.

The foundation's programme, organised openly since January 2026, counts four vulnerable layers across the stack and takes the route only Ethereum can take: account abstraction. Because an Ethereum account can be a small program rather than a fixed key, its signature scheme can become a choice — upgraded per account, opt-in, without a network-wide flag day. The vehicle is EIP-8141, targeted at the Hegotá upgrade; on the consensus side, researchers are building post-quantum signature aggregation (leanXMSS, inside the leanVM research track) with a planning horizon around 2029. The official guidance to users today is exactly one sentence long, in substance: do nothing now — nothing post-quantum runs in production, and when the time comes, the upgrade is designed to arrive account by account.

For the map: Ethereum has a mechanism Bitcoin lacks (programmable accounts) and the same present tense (nothing shipped). Its holders' migration, when it comes, should be the gentlest of any major chain's — a setting changed, not a fortune moved.

Chapter 11 — Solana and the Rest

layer. What it has is the experiment: an opt-in Winternitz Vault (January 2025) — a hash-based, one-time-signature vault where each transfer burns a fresh key, exactly the discipline one-time signatures demand — plus a public post-quantum testnet running since December 2025, and reported (not officially confirmed) convergence among its client teams on Falcon. The active lab is active; its production chain is classical.

phased, with ML-DSA signatures planned for its Devnet in the second half of 2026 and a full transition targeted at 2028 by validator amendment. Its own audit figure is a useful contrast to Bitcoin's: 0.03% of XRP sits in vulnerable dormant accounts.

Falcon-based event signing once the Falcon standard exists; a post-quantum user key type targeted at 2027). Nothing shipped.

(June 2026) and a dedicated post-quantum experimental network (September 2026). Mainnet: classical, no date.

shipped; its founder has publicly cautioned that premature post-quantum cryptography could slow the chain roughly tenfold.

began with hash-based one-time signatures (Winternitz), then replaced them with Ed25519 in 2021 for practicality — and has not been quantum-resistant since, despite two official Europol reports in October 2026 still describing it as post-quantum. Check the chain, not the summaries.

(XMSS) since 2018 — the existence proof that a classical-era chain can run post-quantum signatures from birth, at the cost of managing stateful keys — and is testing ML-DSA for its 2.0.

Chapter 12 — Case Study — Algorand, the Destination Already Running

One major chain has made the crossing, in stages a holder can inspect:

Algorand's ledger state is compressed into a certificate signed with Falcon by the network's node runners — post-quantum signatures doing production work, proving the chain's history to the outside world.

user account (through a logic-signature account): a person, not the protocol, signing post-quantum on mainnet.

release, any holder can generate a Falcon-1024 account from the familiar 25-word mnemonic, in the standard SDKs and the Pera wallet — and, the detail that matters most for Part Four, an existing account can be rekeyed to a Falcon key while keeping its address. The migration, on Algorand, turned out to be a key change, not a move.

Algorand states its own limits as plainly as its milestones, and this book repeats them in the same breath: the Falcon accounts are opt-in, not the default — standard accounts still sign Ed25519; the consensus layer and its VRF still run on classical signatures; and the foundation's own target for broad quantum resilience is end of 2027. The destination exists. It is a district, not yet the whole city.

Why this chain earns a chapter in a book whose worked example is Bitcoin: because every other chapter in this part describes intentions, drafts, and programmes — and holders, reasonably, discount intentions. Algorand is where the book can stop saying "one day, a holder will" and say "since August 2026, a holder can." The shape of its migration — rekey, keep the address — may or may not be the shape of yours. It is the first working sample of the thing itself.

Chapter 13 — A Short History of Algorand

verifiable random functions (1999) — the tool his chain's consensus would later be built on. In 2012 he shared the ACM Turing Award, computing's highest honour, with Shafi Goldwasser, "for transformative work that laid the complexity-theoretic foundations for the science of cryptography." Algorand is a cryptographer's chain in the literal sense.

Zeldovich) and the company's founding.

proof-of-stake* — every round, a block proposer and voting committees are chosen by VRF-based cryptographic sortition, privately, in proportion to stake; blocks are certified and final, with forks designed out. All 10 billion ALGO were minted at genesis.

transfers, and Layer-1 smart contracts.

platform for the World Cup.

Chapter 12: State Proofs, the first Falcon transaction, native Falcon accounts.

The middle years hold few holder-level milestones, and this sidebar does not invent any. Algorand's story, for this book's purpose, is a strong beginning, a quiet middle, and then — alone among the majors — the ending arriving early.

← Part One — The Change That Is ComingContentsPart Three — The Meantime →