The problem with McBits is that it has really large keys. For a 128 bit security level you have one megabyte keys. That may be a reasonably conservative secure

The problem with McBits is that it has really large keys. For a 128 bit security level you have one megabyte keys. That may be a reasonably conservative secure choice if you want post quantum cryptography today for certain applicatoins. But if you want to use it for something like TLS it's pretty much unusable. The lattice based systems look like they could be made to work in a real-world setting. The problem is of course that cryptographers will tell you that they aren't confident what works and what doesn't and what parameters are secure. And there are patents (both for ntru and parts of rlwe), which the article unfortunately doesn't mention. That's basically a dealbreaker for widespread use.