Longer, more detailed explanation: ECDSA and Schnorr on secp256k1 only work while ECDLP (the elliptic-curve discrete logarithm problem: recovering secret d from public key Q = dP) is hard. If you can recover d you can forge spends. That is Cryptomania (the world where public-key encryption and key agreement exist). Bitcoin does not need that. People get this wrong all the time. The chain is public. Nothing is encrypted to a recipient. Bitcoin needs signatures so only the key holder can spend. As @adam3us explained in plain terms: “Bitcoin doesn’t use encryption, rather it uses signature schemes.” That is why “encrypted Bitcoin” pitches cause so much confusion and are misleading. Signatures exist in Minicrypt (the world where one-way functions exist, but public-key encryption does not). Rompel showed in 1990 you can build them from one-way functions alone. The scheme built for this is SHRINCS, from @blksresearch and @n1ckler. It is hash-based, so it does not care about ECDLP, lattices, or any other algebraic assumption. Blockstream already has it running on @Liquid_BTC via Simplicity, and there is a draft BIP for Bitcoin. Public keys can stay ~32 bytes, so addresses do not have to change. Signatures do. Schnorr is 64 bytes. SHRINCS stateful signatures start around a few hundred bytes if the wallet tracks used keys. The stateless fallback is a few KB. Larger sigs are fine because we already have a ton of scaling tech. Lightning, Liquid, Ark, etc. Most activity does not need to hit L1. If we needed to change signatures, this would also probably be a good time to add covenants. So on L1, transactions get heavier and fewer of them fit into a block. Signing is a little slower. Stateful schemes need careful backups. @Blockstream Research did the work so Bitcoin has a path that does not depend on Cryptomania. ECDLP falling retires ECDSA and Schnorr. It does not retire Bitcoin.