Answers are grounded in this paper and cite their sources.
This paper shows that a $390 mass-market quad-core 2.4GHz Intel Westmere (Xeon E5620) CPU can create 109000 signatures per second and verify 71000 signatures per second on an elliptic curve at a 2128 security level. Public keys are 32 bytes, and signatures are 64 bytes. These performance figures include strong defenses against software side-channel attacks: there is no data flow from secret keys to array indices, and there is no data flow from secret keys to branch conditions.
No takes yet. Share an insight, caveat, or question.
Bernstein et al. (2012) studied this question.
Synapse has enriched 5 related papers. Consider them for comparative context: