Can someone remind me why Merkle trees of Lamport signatures aren’t the solution for postquantum asymmetric signing? Sure the signatures are huge, but they’re secure unless you can trivially invert the hash function.