SPHINCS- is an EVM-optimized hash-based signature family that can verify post-quantum signatures in Solidity today, with the main C13 variant at 127K gas and 3,704-byte signatures. The cleaner NIST-aligned SLH-DSA-SHA2-128-24 route comes in around 142K gas with formal Lean/Verity proofs, while a Keccak variant drops verification to 94K gas by giving up bit-exact FIPS compliance. The pitch is account-level PQ hardening without waiting for a precompile or protocol change; the tradeoff is signer work, bounded signature counts, and a future need for ZK-friendlier leanSPHINCS if Ethereum moves this into STARK aggregation.

TLDR by @Benthic