Speaking of Lattice-Based solutions. There has been significant progress in adopting PQ solutions in the real world. Signatures are not as widely deployed, but the work is going on. There is a recent update from Apple:
https://support.apple.com/guide/security/quantum-secure-cryptography-apple-devices-secc7c82e533/web.
An interesting point is that it does not use level 1 security for lattice schemes (it offers level 3 or level 5, both for ML-KEM and ML-DSA). A similar approach was used in Cloudflare:
https://blog.cloudflare.com/pq-2025/. More specifically, see this part:
https://blog.cloudflare.com/pq-2025/#ml-kem-768-and-x25519. Let me cite Bas here: "There is a lot of trust in the (non post-quantum) security of X25519: matching AES-128 is more than enough. Although we are comfortable in the security of ML-KEM-512 today, over the coming decades, cryptanalysis could improve. Thus, we'd like to keep a margin for now."
Cloudflare settles for a smaller margin for ML-DSA, but the reasoning is that they can upgrade later if needed:
"ML-DSA-44 as level 2 is comfortably above level 1. It's indeed below ML-KEM-768. I'd be comfortable with level 2 ML-KEM, but that doesn't exist. Anyway, ML-DSA requires less margin as it doesn't suffer store-now/decrypt-later. We can roll ML-DSA certs if attacks improve, but we can't roll captured data encrypted with ML-KEM."
In our setting, switching to a new set of parameters is more difficult.
So, it seems reasonable that, if we are discussing a lattice-based construction, we should also include some margin. That said, if we exclude level 1 security, the smallest size we get is 3073 bytes for Falcon level 5. See
https://pqshield.github.io/nist-sigs-zoo/ for a quick comparison. Level 3 ML-DSA requires 5,261 bytes.
Of course, lattice constructions have more to offer than just smaller sizes. Different schemes may allow for public key derivation, maybe more efficient multi/threshold signatures, and so on. We should keep in mind that, if we want to include a security margin for possible future improvements, the sizes will be larger.
Best,
Mike