Dang.
Gemini is suggesting FALCON-512 as the most efficient option at around 666 bytes for the sig, with public key itself ~897 bytes (okay still 10x sig size vs K1 but...). Is that flat out wrong or are there some tradeoffs that come with PQ and these "shorter" ones?
The sizes of the keys and signatures aren't even the most important factor. Security of the algorithm comes first. And I just don't know enough.
All I really care about is flexibility at this point -- make things work with any key size and any signature size and any algorithm, so that it is PQ ready, without actually making any choices right now. I'm hoping the cryptographers make better stuff in the future before we need these.
