> Bitcoin, where users would need to migrate their coins to a quantum-resistant scheme

Is that so? I always thought that the design choice that only hashes of the public keys were public was a pretty clever way to make the whole scheme quantum-proof. What did I miss?