We looked into post-quantum digital signature schemes for the Tahoe-LAFS "100 Year Cryptography" project but I stopped looking at all but one of them when David-Sarah Hopwood observed that they all rely on a secure hash function to generate a message representative for the digital signature scheme to sign. Therefore, all of them (except for that one) are vulnerable to either a break of the digital signature scheme or a break of the secure hash function. The one remaining one is hash-based digital signatures.
Hash-based digital signature schemes are secure if the underlying hash function is secure (of course we can and should be more precise about what we mean by "secure" here, but this is good enough for now). Therefore, a hash-based digital signature scheme has one fewer ways to break than any other scheme. That is: a hash-based digital signature scheme can be broken if you can break the underlying secure hash function. All other digital signature schemes can be broken if you can break the secure hash function that they use for generating a message representative, or if you can break the digital signature scheme itself.
So, for Tahoe-LAFS's "100 Year Cryptography" project, we are looking at using hash-based digital signatures. Unfortunately, the best designs we've found or invented so far are still somewhat efficient in both processing time and key size, compared to a high performance quantum-vulnerable scheme like the new ed25519 which can take maybe 88,000 cycles to do a signature or around 280,000 cycles to do a verification (on certain modern Intel chips), with a public key of size 32 bytes and a signature size of 64 bytes.
Julian Wälde has implemented a hash-based digital signature scheme (warning: the details of the scheme have not been widely vetted, so this particular scheme might not retain the security guarantee, predicated on the security of the underlying secure hash function, that I alluded to above), and reported 4 signatures per second, 1700 verifications per second, a public key size of 32 bytes, and signature size of 11,000 bytes. If we assume Julian's development machine is a modern Intel chip running at 2.4 GHz, then it took about 600,000,000 cycles to sign and about 1,400,000 cycles to verify.
On the other hand, it compares well in certain respects to other post-quantum crypto schemes, like McEliece. The Bernstein, Lange, Peters paper you referenced proposes parameters for 128-bit security McEliece signatures in which the public key is 192,000 bytes. That makes the 11,000 byte public keys in Julian's hack look not as terrible.
In fact, Julian's scheme may already perform well enough for our purposes, without any further performance improvements. See the Tahoe-LAFS mailing list for discussion of that.