A fundamental problem with proof of stake is lack of forward security in the following sense. If compromised by a single party gaining majority of keys, the attacker doesn't need to take any further action to maintain control. Assume compromised forevermore. https://twitter.com/BobMcElrath/status/1199839362130882561

This is NOT the same as the "nothing at stake problem." This is a fragility problem.

Proof of work could be temporarily compromised by a sub50% attack if you gain 1/3 of miners, but... that does not mean the chain is compromised forever.

The attacker has to maintain mining supremacy at every time in the future to guarantee the system is broken forever. Otherwise, honest miners have a chance at retaking supremacy. Not so with proof of stake.

One of these two approaches can be used in a financial arms race, and it isn't the system that breaks forever as soon as a monopoly arrives on the scene.