> use symmetric crypto To be clear my comment is specifically only relating to signature schemes, not encryption. > The state is enormous The scheme I linked

> use symmetric crypto To be clear my comment is specifically only relating to signature schemes, not encryption. > The state is enormous The scheme I linked to points towards efficient "pebbling" and "hash chain traversal" algorithms which minimize the local state required in quite a fascinating way (e.g. see https://www.win.tue.nl/~berry/pebbling/ https://www.win.tue.nl/~berry/pebbling/). > tracking state across components and through distribution channels Assuming you have reliable ordering in those channels I don't see how the stateful nature of such schemes makes it hugely more complex than the essential hard problem of key distribution.