[jd007]

SIDH (https://en.wikipedia.org/wiki/Supersingular_isogeny_key_exch...) is one of the few popular post-quantum variants of DH key exchange, and it supports forward secrecy as well.

[the8472]

One nice property of ECC pubkeys is that they easily fit into UDP packets, URIs and other very compact data structures. Currently all post-quantum schemes have fairly bulky pubkeys.

[Zaak]

SIDH keys are 330 bytes long when compression is used, so they too will fit nicely into network packets.