Unlikely that signatures will ever be hybrid.

Fairly likely we move off of hybrid for key exchange once NIST finishes standardization.

Geez, turbolaser X-Wing before it even gets in the air. Can y'all just give us a SCW death-match debate on this?

Jokes aside, it would be interesting to have your optimistic take on the current PQ security trajectory. Do you think that it has proven comparably secure to ECC? Or just that by the time PQ primitives are ready to be rolled out they'll be load bearing enough that it is better to use them solo rather than the added overhead/complexity of a hybrid?

I don't see TLS adopting anything other than the current hybrid or a pure Kyber, but Bas would know better than me.

Signatures are very difficult to do hybrid in a way that's not strippable.

I think lattices are in the realm of boring crypto these days, but I ask the actual mathematical cryptographers when I need real opinions.

We're gonna fight about this!