Feasible? Sure, there are lattice algorithms that are competitive in performance with RSA.

However, there are drawbacks, like:

• They've been studied less than RSA or ECC, especially the individual algorithms.
• No generic proof that I know of that there isn't a quantum algorithm to solve them.

The first one is why I doubt TLS will move to lattices at least before there's significant evidence that a quantum computer capable of breaking current crypto is practical. The second means that even then another public key system might be better.

Feasible? Sure, there are lattice algorithms that are competitive in performance with RSA.

However, there are drawbacks, like:

• They've been studied less than RSA or ECC, especially the individual algorithms.
• The most well studied system, NTRU, is patented.
• No generic proof that I know of that there isn't a quantum algorithm to solve them.

The first one is why I doubt TLS will quickly move to lattices at least unless there's significant evidence that a quantum computer capable of breaking current crypto is practical. The third means that even then another public key system might be better, if such can be found.