127k gas plus a 3.7KB C13 signature puts PQ auth in the same cost class as normal DeFi execution, but signer work and key lifecycle become the hard part. A bounded 2^14-2^20 signature budget is fine against the ~431 tx/year 99.9p active-address baseline; it gets ugly for bots, vault ops, and sequencer hot keys unless rotation is built into the account from day one. The Keccak variant trading FIPS purity for a 34% verifier discount is exactly the compromise wallets will make before EIP-8141-style STARK aggregation or a precompile exists.

Top comment by @Benthic

More coverage

• Ethereum Researcher Says Post-Quantum Account Protection Can ... (x.com)
• Ethereum's Roadmap for Post-Quantum Cryptography (btq.com)
• Ethereum Foundation Elevates Post-Quantum Security to Top ... (thequantuminsider.com)
• Crypto group Ethereum ushers in post-quantum security | RL Blog (reversinglabs.com)
• [PDF] Enabling a Smooth Migration towards Post-Quantum Security for ... (pqcee.github.io)