Hello,

I've recently been reading Blockchain Programming in C# (NBitcoin) and came across this tidbit:

Elliptic Curve Cryptography, the cryptography used by your public key and private key) is
vulnerable to a modified Shor's algorithm for solving the discrete logarithm problem on
elliptic curves. In plain English, it means that, with a quantum computer, in theory, it is
possible in some distant future to retrieve a private key from a public key.
By publishing the public key only when the coin are spend, such attack is rendered
ineffective. (assuming addresses are not reused)

I'd like some clarification here: is the public key only exposed during a transaction because of the transaction signature? To my understanding a public key may be retrieved from an ECDSA signature. The public key cannot be derived from the script hash due to the hash being an irreversible operation.

If the above is true, then does that mean in the distant future, signing messages for the purpose of verification as well as holding funds on an address which has already been used may be compromised?

Thanks in advance for any clarification.