Developers Publish a Migration Path for Post-Quantum Signatures

A draft specification circulated on the development mailing list this week sets out the first concrete migration path toward quantum-resistant signatures, proposing a new opt-in output type rather than a hard cutover.

The design pairs a hash-based signature scheme with a staged deprecation of existing key formats spanning roughly a decade. Its authors are explicit that the timeline is driven by coordination difficulty rather than any assessment that cryptographically relevant quantum computers are imminent.

The dormant-coin problem

The hardest question is not cryptographic. Millions of coins sit in outputs whose owners are unreachable or dead. Any scheme that eventually invalidates legacy spending conditions confiscates those coins; any scheme that does not leaves a standing pool of vulnerable value.

There is no version of this where the social layer does not have to make a decision it would rather not make.

Reviewers broadly welcomed the specification's conservatism while questioning its signature sizes, which would materially increase the cost of the transactions using them. The authors describe that as an acceptable price for a scheme whose security assumptions are unusually well understood.