SPHINCS+ shows up in custody, because apparently MPC/HSM stacks now need a post-quantum veto layer.