Two different threats. Two different locks.
A quantum computer breaks elliptic curves and leaves hashes and, as far as anyone has proved, lattices. A shortcut in the structured math would hit lattices and might hit curves. Those are not the same failure, and this site will not pretend one algorithm covers both.
CHOOSE
What are you actually doing?
Job
Worry
This is the case for a hash signature. It does not use a lattice or a curve. It is 17,088 bytes, so it is the conservative choice, not the compact one. Python cannot run it until cryptography ships FIPS 205.
SLH-DSA-SHA2-128fTOUR
What the other pages do
- Exchange
Two parties agree on a secret. Hashes cannot do this part.
- Sign
Lattice plus Ed25519. Both halves must pass. Aimed at a quantum computer.
- Hash
SLH-DSA. No lattice and no curve. Larger today, not smaller.
- Mail
That secret becomes an encrypted session. It is not forward secret.
- Bitcoin
Leave the address unused. Commit 32 bytes. Keep the signature off chain.
- Envelope
A lattice computation with a short horizon, not archival secrecy.
IN THIS BROWSER
A key agreement, then a signature
Pressing the button creates an X-Wing key, encapsulates a secret, decapsulates it, and signs a short message. It then flips one bit of the signature. Keys are thrown away when the function returns. The first run on a phone can take a few seconds. That is ML-DSA key generation, not a stall.
Idle
SIZES
The hybrid is mostly the lattice half
A Bitcoin OP_RETURN output holds 80 bytes. The hybrid signature is 3,373 bytes, so it cannot go in the transaction. The hash signature is larger still, 17,088 bytes. The Bitcoin page puts a 32-byte hash of the attestation on chain instead.