Classic McEliece is 40 years old and still kicking.
The problem is the key size: 512 kb for normal use, 8.5 Mb against quantum computers. On the other hand, 1 MB is not that much if you really want the security.
The problem is the key size: 512 kb for normal use, 8.5 Mb against quantum computers. On the other hand, 1 MB is not that much if you really want the security.
They're even trying to replace RSA at ~2kb per key.
Part of it is also the human factor. Crypto is way easier if your keys are short enough to write down. You don't really want to be moving keys around on flash drives, it's hard to secure erase files unless the drives themselves are encrypted.
If we learned anything from the past it's that crypto works and can be deployed if it integrates without users noticing much and if the computational and speed overhead is small (or negative, which in the HTTPS case it often is).
There are plenty of middlebox devices on the Internet that will drop your traffic if you send anything HTTP over them that they don't understand. So you're kinda "locked in" in not deploying new protocol features. Encryption provides a way out of this.
McEliece ciphertexts are unusually small for post-quantum cryptography. The small ciphertext size can be much more important for total traffic than the large key size.
McEliece is relatively fast and has really fast implementations in hardware, so the speed is less off a problem. It does just binary vector operations. Encapsulation is just one pass.