Assuming quantum computing at the caliber necessary for cryptographic functions is even possible (we're not certain of this!), it is reasonable to also assume that a quantum processor can crack any non-quantum cypher (quantum computers examine all possibilities simultaneously), so it basically doesn't matter (we're screwed if it comes, there'd be no way to upgrade fast enough).
If you're trying to get a date for when quantum cracking arrives and then use Moore's Law to determine what key size is still uncrackable by non-quantum computers around that time, I suppose that's admirable ... but there's no way to forecast that as it's essentially waiting for a series of scientific and/or mathematical breakthroughs.
Our one saving grace may be that the number of possibilities a quantum cracker can examine is limited to a certain key size; iirc, the proof-of-concept quantum computers we have can only examine a dozen or so possibilities. This is convenient because it means you want a larger key size, which is the same kind of future-proofing we already employ in order to combat Moore's Law.
Just make large keys according to your performance requirements (larger is better, but too large can be too slow). This is the best you can do. If you're lucky, quantum computing will either never arrive or else never be able to handle the kind of entropy dictated by your large keys. That's also assuming we don't suffer an independent mathematical breakthrough that trivializes decryption speeds with or without a quantum computer.
But first things first: Where's my flying car?
Edit: Okay, we're closer than I thought (I answered that off the top of my head and I was not fully up to date), though I still stand by what I said earlier. The NSA is actively pursuing this but doesn't appear to have made much progress. D-Wave has even made "real" quantum computers, albeit without the ability to crack RSA beyond a key size of 128 bits; GCN reported about two years ago on this:
Ladizinsky says much of the government’s interest in quantum computing has to do with code breaking. To break 128-bit RSA encryption the traditional way would take 2,000 workstations and supercomputers about eight months. For 256-bit encryption, it’s a million years. And for 600-bit encryption, it would take the age of the universe. But with quantum computing, the size of the problem doesn't matter so much, because a powerful enough quantum machine could look at all the possibilities at once. Although Ladizinsky says the D-wave machine is not specifically designed to break encryption, he knows others are experimenting heavily in that field.
See also this crypto.SE question on why D-Wave can't crack RSA.
