Post-quantum alternative to ElGamal? (public key verifiability)

Question

Are there any alternatives to ElGamal that would be resistant/annoying to quantum machines?

I would like to preserve public key derivability/verifiability -- ability to ensure existence of corresponding private keys for made-up public-keys.

I've looked up several other cryptosystems from NIST proposals of post-quantum cryptography, but by directly reading the papers it looks like they lack this property.

For instance NTRUencrypt is a lattice-based cryptosystem. As it operates under a lattice field in theory public keys could be randomly generated without private ones. But I'm not sure that there would be a way to ensure existence of private keys and possibility of decryption (although the private key space could be large enough and this assumption would somehow hold).

Answer 1

There is nothing quite meeting your requirements, especially if you require the ability to generate random valid public keys without knowing the corresponding private key. CSIDH (not a NIST candidate) comes closest, in that you can at least generate random private keys and easily publish the corresponding public keys verifiably.