QUIC requires that servers reuse keys so that session resumption works. That breaks many post-quantum key exchange systems.

I am looking for a post-quantum key exchange algorithm with the following properties:

• Fast (Lattice-based)
• IND-CCA2
• The chosen key depends on randomness from both parties (this is important for many uses of channel binding).