As long as the speed difference isn't orders of magnitude, and you are doing many, many session inits, I don't see this to be a real argument. For embedded syst

As long as the speed difference isn't orders of magnitude, and you are doing many, many session inits, I don't see this to be a real argument. For embedded systems, the difference is indeed at least 10x. As we observed running Dilithium on RV32I on the Tillitis Tkey (https://tillitis.se/ https://tillitis.se/). EdDSA takes about a second, which is ok for a single signature. ML-DSA on the same platform is ~20 seconds. But yes, if you are a web server and don't scale automatically with number of sessions, the better performance is good. The negative thing for all systems with the current NIST PQC algoritms are the longer keys, which gets even worse when going hybrid. See the experiments by Cloudflare for example with PQC in TLS, and adding PQC keys in certificates. I agree that for certificates, there is a possibility of being compatible with legacy systems by adding the ML-DSA signature as an extension (and the legacy system being able to handle the larger certs). But please show references for the main reason for hybrid is compatibility. IF we look at the motivation for the TLS 1.3 hybrid scheme it states: "The primary goal of a hybrid key exchange mechanism is to facilitate the establishment of a shared secret which remains secure as long as as one of the component key exchange mechanisms remains unbroken." (https://www.ietf.org/archive/id/draft-ietf-tls-hybrid-design-10.html https://www.ietf.org/archive/id/draft-ietf-tls-hybrid-design...) That page states that backwards compatibility maybe is one of several possible additional goals. But it is not the main goal. The problem PQC algorithms must solve is not only to be resistant to attacks by future quantum computers but also against attacks on classical computers. And the hardness in terms of security as the number of bits in the key must scale about as fast as classical algorithms. And work as about well a classical algorithms on classical computers. All ciphers have warts. The ones we use are the ones we think are secure, but also have warts we can live with. RSA scales slowly with number of bits (and have other warts). EC scales faster and becomes faster than RSA for the same strength, but has other warts. McEliece seems like a good, conservative PQC algorithm, but those keys... TDEA was deemed to provide a too low security margin, but it also was to slow (48 rounds) and with a too small block size.