On your "why not just migrate?" question, I think there are two answers, and the second one shows where the scheme is weak.
Why a mine is cheaper than migrating: the "proof from before some date" can be a plain hash commitment, for example H(privkey || new quantum-safe address), timestamped before the cutoff. You don't need an on-chain tx per UTXO for that. One OpenTimestamps-style merkle root can commit to millions of keys, with no fees, no new on-chain footprint and no linking of your coins today. Migrating means one real transaction per UTXO, which costs fees, takes block space and leaks privacy. Mines are a way to protect coins without touching them.
Where it's weak: the deterrent only works through the attacker's uncertainty. With collateral equal to the coins, a rational attacker sweeps a UTXO whenever P(mine) < ~50%. And attackers can estimate P(mine) per UTXO:
Untouched 2009-2011 P2PK coins (Satoshi-era, likely lost keys): P(mine) is close to 0. Dead people don't timestamp commitments.
Coins that moved recently, or belong to known active entities: P(mine) is high, but those owners could have migrated anyway.
So mines mostly protect the coins that would have been fine anyway. The ~1-2M BTC that drive the whole quantum debate (lost/dormant P2PK) stay exactly as exposed as before. Nobody alive can plant a mine on them, and the attacker knows that.
Two more practical points:
Verifying the reveal needs a new consensus check (does this preimage really correspond to this address's key?). That's a soft fork in itself, on top of the timelock + collateral rules.
The collateral requirement means an honest legacy holder who never heard of any of this has to find matching quantum-safe sats just to spend their own coins after q-day. That's a real usability cost, borne by exactly the least-informed users.
I still think it's clever as a complement to a freeze/sunset proposal: it gives active holders a cheap, private insurance layer. It just doesn't solve the dormant-coin problem by itself.
On your "why not just migrate?" question, I think there are two answers, and the second one shows where the scheme is weak.
Why a mine is cheaper than migrating: the "proof from before some date" can be a plain hash commitment, for example H(privkey || new quantum-safe address), timestamped before the cutoff. You don't need an on-chain tx per UTXO for that. One OpenTimestamps-style merkle root can commit to millions of keys, with no fees, no new on-chain footprint and no linking of your coins today. Migrating means one real transaction per UTXO, which costs fees, takes block space and leaks privacy. Mines are a way to protect coins without touching them.
Where it's weak: the deterrent only works through the attacker's uncertainty. With collateral equal to the coins, a rational attacker sweeps a UTXO whenever P(mine) < ~50%. And attackers can estimate P(mine) per UTXO:
So mines mostly protect the coins that would have been fine anyway. The ~1-2M BTC that drive the whole quantum debate (lost/dormant P2PK) stay exactly as exposed as before. Nobody alive can plant a mine on them, and the attacker knows that.
Two more practical points:
I still think it's clever as a complement to a freeze/sunset proposal: it gives active holders a cheap, private insurance layer. It just doesn't solve the dormant-coin problem by itself.