SHRINCS

Stateful hash-based signatures with a stateless fallback.

~324-byte signatures when state is intact.