ECDSA is expected to age out of efficacy soon due to harvest-now-decrypt-later threats of quantum computers. Draft US NIST guidance is deprecating ECDSA for Federal systems from 2030 and disallowing it from 2035 onward:
https://nvlpubs.nist.gov/nistpubs/ir/2024/NIST.IR.8547.ipd.pdf
Biggest issue for Bitcoin is that adopting mitigations like FIPS-204 ML-DSA (previously "DILITHIUM") that US NIST recommends would mean growing signature size from 64 bytes to 2,420 bytes (also public key sizes grow to 1,312 bytes, and 5X CPU to sign - though verification is actually faster).
ECDSA is expected to age out of efficacy soon due to harvest-now-decrypt-later threats of quantum computers. Draft US NIST guidance is deprecating ECDSA for Federal systems from 2030 and disallowing it from 2035 onward: https://nvlpubs.nist.gov/nistpubs/ir/2024/NIST.IR.8547.ipd.pdf
Biggest issue for Bitcoin is that adopting mitigations like FIPS-204 ML-DSA (previously "DILITHIUM") that US NIST recommends would mean growing signature size from 64 bytes to 2,420 bytes (also public key sizes grow to 1,312 bytes, and 5X CPU to sign - though verification is actually faster).