QUIC requires that servers reuse keys so that session resumption works. That breaks many post-quantum key exchange systems.
I am looking for a post-quantum key exchange algorithm with the following properties:
- Fast (Lattice-based)
- The chosen key depends on randomness from both parties (this is important for many uses of channel binding).