Bitcoin's first post-quantum signature BIP arrives with its tradeoffs already conceded

Take the shrink factor at face value. Blockstream's more palatable path is to compress NIST-approved hash-based post-quantum signatures by around 13.23 times ^[8], and the current NIST-endorsed hash and lattice schemes run 38 to 123 times larger than Bitcoin's ECDSA and Schnorr signatures ^[4]. Divide one by the other and you get a range of about 2.9x to 9.3x ^[2], which is how a post-quantum signature ends up roughly nine times a 64-byte Schnorr ^[14]. That holds at the floor: 548 bytes plus a 48-byte public key, so 596 bytes of new material per spend ^[10][6]. The ceiling is where it stops holding. At 4,619 bytes ^[10], a SHRINCS signature is about 72 times a Schnorr one ^[1], back inside the band the design exists to escape ^[4].

The throughput table has the same shape. Blockstream's earlier research, at slightly different parameters, put Bitcoin at 6.5 transactions per second if everyone used Taproot's Schnorr, and notes that about 80% of users do not ^[16]; the lattice-based ML-DSA lands at 0.5 and the hash-based SPHINCS+ at 0.36 ^[17]; SHRINCS comes in at 3, which Cointelegraph describes as similar to today ^[18]. So SHRINCS keeps 46% of the all-Schnorr estimate ^[3] while delivering roughly 8.3 times the throughput of SPHINCS+ ^[4]. Note which comparison is real: the 6.5 figure describes a chain nobody runs ^[16], and a fraction of 1 TPS is what any of the unmodified NIST options would deliver ^[5].

The other road is the one Ethereum's post-quantum team is taking, aggregating signatures into one small zero-knowledge proof per block, which in Bitcoin would leave the chain running faster than it does now because a single proof takes less blockspace than a pile of signatures ^[6]. It would also, per Cointelegraph, be a fairly radical change facing a steep uphill fight to activation, and Blockstream kept it apart from the SHRINCS proposal ^[7][8]. That separation is the tell. What gets filed alone is the conservative offer: security resting on the SHA-256 assumptions Bitcoin mining already depends on, with BIP-39 seed recovery intact, in the words of PostQuantum.com author Marin Ivezic ^[11]. Ivezic rates it the strongest answer yet to going post-quantum without wrecking Bitcoin's block economics, and in the same breath says it is early, unaudited, and has not had the years of public cryptanalysis the NIST signatures absorbed ^[12][13].

Jonas Nick's own framing does more work than any single byte count. A proposal whose author states it is not intended to be Bitcoin's final signature scheme and is not optimal along every axis ^[3] is not asking to be ratified; it is naming a price and waiting for counteroffers. Nobody disputes the threat, only its date ^[20]. What is in dispute is the bill: witness weight per signature, at a parameter set somebody has to choose, from code that has signed real transactions on Liquid mainnet ^[13] and almost nothing else.