Sophie Schmieg (head of Google's cryptography team) has a good post answering this: https://keymaterial.net/2025/12/13/a-very-unscientific-guide-to-the-security

Sophie Schmieg (head of Google's cryptography team) has a good post answering this: https://keymaterial.net/2025/12/13/a-very-unscientific-guide-to-the-security-of-various-pqc-algorithms/ https://keymaterial.net/2025/12/13/a-very-unscientific-guide... She also notes, as a side remark in a different post: "I would say that my trust in lattice cryptography is pretty much equal to my trust in elliptic curves, and quite a bit higher than my trust in RSA." (https://keymaterial.net/2025/11/27/ml-kem-mythbusting/ https://keymaterial.net/2025/11/27/ml-kem-mythbusting/)