> RSA-4069? That's pretty damn hefty

This surprised me for a different reason: I was under the impression that effective security bit size does not scale linearly with bit lengths in RSA, and that key size would need to be 16,000-bits long for a comfortable safety margin (a size not practical and not supported by RSA).

Are there any practical reasons why one shouldn't use epileptic-curve based crypto?