Anything protected by RSA key transport or (EC)DH key exchange, including TLS, SSH, VPN and messaging sessions, can be stored and decrypted later if the key exchange falls. Forward secrecy does not help, because the attacker breaks each ephemeral exchange from the recorded handshake. Data whose confidentiality must outlast the time until a cryptographically relevant quantum computer exists is already at risk: Michele Mosca's rule of thumb says to worry if the years the data must stay secret plus the years a migration takes exceed the years until such a computer arrives.
The mitigation is hybrid post-quantum key exchange now: X25519MLKEM768 in TLS 1.3 (default in major browsers and many servers since 2024–2025), mlkem768x25519-sha256 in OpenSSH 10, PQ3 in iMessage and PQXDH in Signal. Signatures are not affected retroactively: forging a signature later does not change past authentication, so signature migration can follow, except for long-lived signatures such as firmware roots and documents.