ɴɪsᴛ ᴊᴜsᴛ ᴘᴜᴛ ᴀɴ ᴇɴᴅ ᴅᴀᴛᴇ ᴏɴ ᴇʟʟɪᴘᴛɪᴄ-ᴄᴜʀᴠᴇ sɪɢɴᴀᴛᴜʀᴇs. ʜᴇʀᴇ ɪs ᴡʜᴀᴛ ɪᴛ ᴍᴇᴀɴs ꜰᴏʀ ʙɪᴛᴄᴏɪɴ, ɪᴛs ʟᴀʏᴇʀ 2s, ᴀɴᴅ ᴡʜʏ ɢᴏᴀᴛ ɴᴇᴛᴡᴏʀᴋ ɪs ᴏɴᴇ ᴏꜰ ᴛʜᴇ ꜰᴇᴡ sʜᴏᴡɪɴɢ ɪᴛs ʜᴏᴍᴇᴡᴏʀᴋ. ᴡʜᴀᴛ ɴɪsᴛ ᴘᴜʙʟɪsʜᴇᴅ On October 27, 2026, NIST released the final IR 8547, Transition to Post-Quantum Cryptography Standards. Quantum-vulnerable public-key cryptography, including ECDSA and EdDSA, is deprecated after 2030 and disallowed after 2035. "Deprecated" means you can still use it but accept the risk. "Disallowed" means you cannot. NIST also notes that no cryptanalytically relevant quantum computer exists today. The most sensitive U.S. federal systems face earlier deadlines: 2030 for key establishment, 2031 for signatures. ᴡʜʏ ʙɪᴛᴄᴏɪɴ sʜᴏᴜʟᴅ ᴄᴀʀᴇ The schedule governs NIST standards and federal systems, not Bitcoin directly. But the math is shared. ECDSA and elliptic-curve schemes fall to Shor's algorithm on a capable enough quantum computer, and Bitcoin signs over secp256k1. Two draft BIPs, BIP-360 and BIP-361, exist, but neither is activated and Bitcoin has not specified a post-quantum scheme. sᴛᴇᴘ ᴏɴᴇ: ᴀɴ ʜᴏɴᴇsᴛ ɪɴᴠᴇɴᴛᴏʀʏ NIST tells organizations to start with a cryptographic inventory. An Applied PQC paper uses @GOATNetwork as the worked example for a Bitcoin layer 2 and maps seven surfaces: 1. Settlement outputs (secp256k1/Schnorr): exposed. Only Bitcoin can fix it. 2. Peg-in covenant (MuSig2): exposed. GOAT can only bound the risk within Bitcoin's output types. 3. Bridge proof system (Groth16/BN254 wrap): exposed at the wrap. GOAT and ZKM own it; a replacement has been introduced and measured. 4. Bridge commitments (Winternitz): already post-quantum. 5. Consensus keys (secp256k1): exposed until rotated. GOAT owns it; design published. 6. Execution accounts (ECDSA): exposed. Follows Ethereum. 7. EVM precompiles: pairing and curve precompiles exposed. Inherited from Ethereum; inventory taken. ᴡʜᴀᴛ sᴛᴀɴᴅs ᴏᴜᴛ ᴀʙᴏᴜᴛ ɢᴏᴀᴛ ɴᴇᴛᴡᴏʀᴋ - It did the inventory in public and named its exposed surfaces instead of hiding them. - One surface, the Winternitz bridge commitments, needs no migration at all. - With ZKM, it has introduced and measured a replacement for the Groth16 wrap. - Its consensus-key rotation design is published, not just promised. - It is clear on ownership: Bitcoin owns row one, Ethereum owns the last two, GOAT and ZKM own the bridge proof system and consensus keys. ᴛʜᴇ ᴛʀᴀᴅᴇ-ᴏꜰꜰs, ɪɴ ɴᴜᴍʙᴇʀs Per GOAT's design, moving consensus keys to ML-DSA-65 verifies faster (23 µs vs 173 µs) but signs slower (196 µs vs 46 µs) and is much larger: about 66 KB of commit signatures per block at 20 validators, against 1.3 KB. Publishing costs like these is what serious migration planning looks like. ᴛʜᴇ ʟᴇssᴏɴ ꜰᴏʀ ᴇᴠᴇʀʏᴏɴᴇ Adding a post-quantum algorithm does not finish a migration until the old path is retired, because an attacker simply uses the old one. Retire the old path, or the upgrade protects nothing. You can read the full inventory here https://t.co/rfyzKnqWof