Classical asymmetric cryptography is commonly based on the Discrete Logarithm Problem and Integer Factorization, which are known to be solvable with a quantum computer if it has the ability to run Shor's algorithm, or an algorithm that solves these is devised to run on a classical computers.
Nowadays we know this is impossible to come at least in a few decades. But that doesn't imply that a passive eavesdropper gathers key exchange handshake packets where the symmetric key is negotiated.
The eavesdropper could decrypt the communications associated with these key negotations once the aforementioned quantum computer is built. For example, in the past, cryptosystems that were being used ended up being vulnerable to attacks so a specialized attacker could recover all the stored private information during years.
The evident matter here is that moving to post-quantum cryptographic schemes in the present would stop an attacker in the future to recover private information once conventional asymmetric schemes are broken. I know these schemes are being analyzed right now i.e NIST calling for new post-quantum crypto schemes.
Q1: Is there any institution or government in the present implementing for example NTRU, SIKE or multivariate crypto schemes on their communication establishment to prevent past private information recovery?
Q2: What would be a good estimation on time (i.e years) to move on to these post-quantum cryptographic schemes? I mean, we cannot wait until these attacks are possible on a theoretical capable quantum-computer.
