Your address is a short fingerprint of your public key. Until you sign something, only the fingerprint is public.
The idea: Your address is a fingerprint of your public key, not the key itself. Until you sign a transaction, the world only knows the fingerprint, and hashes are believed to hold up against quantum computers. Once you sign, your public key can be recovered from the signature, so from then on a quantum attacker could, in principle, work out your private key.
Why it matters: Accounts that have never sent a transaction keep their public key hidden from future quantum attackers.
On the map: last 20 bytes of Keccak(pubkey). 160 bits means only ~2^80 work to find an address collision
An Ethereum address is the last 20 bytes of the Keccak-256 hash of the public key[1]. Until an account signs something, only this hash is public, which hides the key from a future quantum attacker.
Because addresses are only 160 bits, finding two keys or deployments with the same address takes about 2^80 work[2], expensive but not out of reach for a very well-funded attacker. That is a known concern for contracts deployed to precomputed (CREATE2) addresses[3].
If any of these breaks, this breaks too.
If this breaks, these break with it.