Suggestion: support slh-dsa

[gkgoat1]

I am developing an authorization system to augment an end-to-end encrypted user system. The existing encryption system uses slh-dsa for signatures because it was proven correct provided the security of the hash function used, so aupporting it in biscuits would help the augmentation.
One note is that slh-dsa signatures are far larger than elliptic curve signatures, so biscuits embedding them would be substantially larger. Otherwise, it seems like a drop-in replacement for the uses of elliptic curve signatures here, and could be another supported signature format.

[aww-aww]

It would also be great to update the FAQ with details about what is planned in terms of PQC support and likely timing.

[divarvel]

Hi, I actually have a draft blog post about our PQC stance.

The tl;dr: is that for now we recommend tightening key rotation, while we are assessing PQC signature schemes (the biscuit protocol supports cryptographic agility, so including new schemes is indeed possible). In addition to slh-dsa, we're considering dilithium and mayo2.
Ideally we'd like to bless one scheme to keep things single. Key factors will be signature and public key sizes indeed, as well as maturity, support, and of course performance.