For years, planning for post-quantum cryptography (PQC) was framed as a future problem: important, inevitable, but distant.