¹Since breaking the authentication is only detrimental during the execution of the protocol, and not after, there are proposals to consider classical digital signatures that are safe for a certain duration to still gain an advantage by using QKD, see [37] for instance.