The problem with McBits is that it has really large keys. For a 128 bit security level you have one megabyte keys.
That may be a reasonably conservative secure choice if you want post quantum cryptography today for certain applicatoins. But if you want to use it for something like TLS it&#x27;s pretty much unusable.
The lattice based systems look like they could be made to work in a real-world setting. The problem is of course that cryptographers will tell you that they aren&#x27;t confident what works and what doesn&#x27;t and what parameters are secure. And there are patents (both for ntru and parts of rlwe), which the article unfortunately doesn&#x27;t mention. That&#x27;s basically a dealbreaker for widespread use.