In Bitcoin, this has been ignored for years.
The worst-case scenario is that a government or private entity secretly builds a sufficiently powerful quantum computer.
In fact, this is the most plausible scenario because they would have an enormous tactical and competitive advantage. They would have no interest in making it public because they could spy on all their opponents and could also destroy all confidence in Bitcoin in a matter of minutes.
quotingThe debate that Willy Woo has reignited about quantum computing and taproot is interesting.
nevent1q…79yz
While I believe that it will take many years and decades to see quantum computing as we imagine it, I do believe that taproot was a design flaw in every respect.
As I have mentioned many times, there is widespread suspicion that taproot was approved due to pressure from Core members who had stakes in mining pools.
But the truly amusing aspect is that taproot addresses are less secure than segwit addresses, significantly less secure, given that taproot addresses permanently display the public key.
A state attacker, for example, could collect Taproot addresses (and other vulnerable ones such as P2PK and Bare multisig/scripts with direct pubkeys) and decrypt their private key.
In segwit addresses (also P2PKH and P2SH/P2WSH), this is not possible, since the public key is not exposed; it is only possible at the moment of spending, which is when the public key is exposed, i.e., while it is in the mempool waiting to be confirmed.
This reduces the window to minutes and greatly reduces exposure to attack.
The example to follow is that of Signal and SimpleX, which improve their encryption algorithms with every step they take and prepare for quantum computing well in advance.
Meanwhile, Bitcoin is more concerned with allowing spam and shitty protocols like Citrea.
This has less and less of a future.