Is there a truly safe signing algorithm? After reading this question, I'm pretty shaken up. A determined attacker with $100 in loose change can crack any RSA key in a couple of hours. After believing that these algorithms would take millions of years to brute force, I'm questioning the security of everything.

What should I move to if RSA isn't safe anymore? Are Elliptic Curve signatures likely to have a similar crack in the near future?
The signing algorithms most often used nowadays are:


RSA based signature algorithms such as RSA-PKCS#1 v1.5 and the more recent RSA-PSS (currently specified in PKCS#1v2.2)
ECDSA, which is the "Elliptic Curve Digital Signature Algorithm", which will probably become the most used one, if not already, since RSA is not as efficient in practice as ECDSA for signing purpose, while validation of signature is faster with RSA. (You can see the Crypto++ benchmarks to get a better idea of their performance)
EdDSA, which is gaining more and more traction nowadays, as it is both easy to implement and secure, plus it is even faster than ECDSA and has plenty of secure open-source code available to use it.
DSA, which has lost the battle and is now less and less encountered on the field, since it is somewhat too complicated for nothing (we use to say it's because the better Schnorr's signatures were patented, that DSA had to circumvent, which made it a too convoluted algorithm)


None of these algorithm have been definitively broken, but it is true that certain instances of them are known to be weak.

First and foremost, note that RSA with a key of 2048 bits or more, is considered secure and should be fine for the next 10-15 years.
So are instances of the other algorithms such as ECDSA with secp256k1, EdDSA with Curve25519, known as Ed25519, etc.
This basically means that the crypto we use nowadays is not easily broken, since it would require both extreme computing power and patience to break it. (As pointed out in the comments, this translates also into large costs, but estimating the costs of breaking these instances would be a question in itself. See for example this question about 256 bits security and the cost of breaking it and keep in mind that we are generally considering anything that is belove 100 bits of security as broken.)

Typically in the question you linked, the RSA algorithm is used with a 512-bit modulus, which is known to be weak, as it is said to correspond to roughly 50-bits of security.

It is also true for the other algorithm, ECDSA, DSA, etc. that if you use them on too small groups, that it is possible to break them, however RSA is probably the one algorithm which has seen the most teams trying to break always larger modulus, there are even RSA challenges which used to have money at stake (but they were discontinued in 2007).

But the discrete logarithm world (on which most other signing algorithms are based) is not left behind and there are (fewer) teams working on trying to break it too. 

So, in the end, there is no need to be questioning the security of everything because RSA has been broken when used with 512-bits modulus, however if someone were to come up with a device (maybe a quantum computer) able to break RSA with 2048-bits modulus, or 4096 bits, in a reasonable (typically polynomial) time, then we should all be worried. 

But there is currently a competition to try and find the so-called post-quantum primitives that will safeguard us against such things.