Using encryption schemes for identification
Well, that would work, but identification is not enough for SSL.

You would need to make the PKE scheme one-way against CCA1 attacks. $\:$ (On the

other hand, it wouldn't need any semantic security.) $\:$ Sending back H(S') would change

the required security notion to one that's even farther from what's been studied.

You could use a tag-based PKE scheme that is one-way against tag respecting CCA2 adversaries to allow the private key holder to also authenticate data to the verifier, which would be enough for SSL. $\:$ (Although it would take 2 messages from the server and 1 from the client, rather than just 1 each.) $\:$ Also, hash-based signature schemes using fractal trees don't necessarily have a limited number of signatures.