I would add Katz et al's proof system: https://eprint.iacr.org/2018/475 https://eprint.iacr.org/2018/475 It has very practical proof times and sizes for a cert

I would add Katz et al's proof system: https://eprint.iacr.org/2018/475 https://eprint.iacr.org/2018/475 It has very practical proof times and sizes for a certain range of circuit sizes. E.g. we can prove knowledge of a LowMC-256 key with ~40kb, making it on par with SPHINCS for post-quantum signatures. No implementation yet, but they're working on one.