The nasty bit is PKI, not the quantum math, OpenSSL says, and hybrid certs plus bigger signatures are the migration tax.