More or less all of the "serious", actually deployed PQC schemes involve lattices, going back before the competition.

I've seen some Classic McEliece deployments, too. Well, I know of only one: Mullvad.

https://github.com/mullvad/mullvadvpn-app/blob/main/talpid-t...

Some helpful, perhaps valid context is that lattice-based cryptography was a contender even before PQC became a thing (NTRU being the obvious example).

Really the only point I'm trying to make here is that there's nothing eyebrow-raising about systems using lattice crypto; after IFP/FFDLP stuff like RSA and ECDLP, lattices are maybe the next most mainstream approach to constructing asymmetric systems.

I'm late to the party, but McEliece codes have also been around for a very long time, predating AES by a fair margin. The biggest problem with them is that the public keys are gigantic and the private keys are very large - even bigger than the keys used in lattice-based cryptosystems. This has caused them to always be a sort of fringe form of cryptography.

The good part is that McEliece codes are based on a proven NP-hard algorithm, so cracking them in polynomial time needs P = NP.

Green explicitly mentions Kyber in his post.

> NIST-approved schemes based on lattice problems include Kyber and Dilithium (which I wrote about recently.)

> Chen’s algorithm does not immediately apply to the recently-standardized NIST algorithms such as Kyber or Dilithium.

And it's not just Signal. Apples new iMessage protocol, PQ3, uses Kyber, too. [1] Most deployments of PQ-crypto that I know of have used Kyber.

[1] https://security.apple.com/blog/imessage-pq3/

Kyber is the fastest KEM after Rainbow. Once Rainbow was broken, Kyber was the obvious choice. NIST delayed as long as it did to perform due diligence.

Rainbow is not a KEM, but a signature scheme.

Signal will always be selecting different algorithms by virtue of being a security focused privacy tool. The past 5-7 years have been kind of an anomaly for cryptography where the industry collectively decided EC and friends were "good enough". PQC has brought back the algorithm churn crypto folks love/hate.