@VitalikButerin: El Salvador's multi-address Bitcoin strategy is quantum-smart

My off-the-cuff guess (low confidence!) is that what El Salvador is doing is actually smarter than what CT thinks: * Used addresses are quantum-vulnerable because the ECDSA pubkey is leaked, unused addresses are quantum-resistant because they're secured by hashes * The reason to split into *multiple* unused accounts is a UX convenience, it lets you spend coins from one account without leaking the pubkey for the others * Yes, the "correct" way to do this is to have a deterministic wallet and put change into a new address. But this is actually not so simple: to be able to pre-generate new addresses you have to have the master pubkey, and once you have the master pubkey and the privkey for any child address, you can recover the privkey for all the other child addresses. You could generate new addresses in cold storage and never take them out, but that makes accounting hard, you can't check where your coins are onchain. * Therefore, just pre-generating a fixed number of addresses and taking them out is simpler.