A quantum-safe signature that's tiny, about 200 bytes including its key, but slow to create.
The idea: Your public key is a curve you reached from a standard starting curve along a secret route of isogenies. To sign, you commit to another random curve, get a challenge from the message hash, and answer with a route connecting the curves that you can only find quickly because you know your secret route. Routes are short to write down, so keys and signatures are tiny. Finding them takes heavy math, so signing is slow.
Why it matters: Attractive where space is tight. NIST is still evaluating it.
On the map: compact signatures
An isogeny-based signature[1] with the smallest public key plus signature of any post-quantum scheme: 65 + 148 bytes at the lowest security level[2], at the cost of slow signing. It advanced to round 3 of NIST's additional signature process in May 2026[3].
It rests on the isogeny path / endomorphism ring problem.
If any of these breaks, this breaks too.
If this breaks, these break with it.
Nothing on the map depends on it: it is an end point, something people use directly.