When — and how — to prepare for post-quantum cryptography