Layered encryption in mixnets with post-quantum cryptography I am trying to implement a mixnet using post-quantum public-key crypto. Each message may be encrypted by up to 10 levels of public keys, shuffled, before the layers of encryption are stripped off one by one.

This is traditionally achievable in RSA, because the ciphertext is barely larger than the plaintext, but in the many popular post-quantum public key cryptosystems (based on lattice crypto), such as NTRU, it appears the ciphertext becomes an order of magnitude larger than the plaintext. So encapsulating a message in multiple layers of encryption is infeasible as the ciphertext doesn't scale.

Are there post-quantum public key exchange schemes suitable for this purpose? I've looked at the Open quantum safe project, but am unsure whether any of protocols there mitigate this issue, or are mature enough.
Might I suggest using traditional hybrid cryptography to cut down on the ciphertext growth size?  This is the straight-forward approach where you don't directly encrypt the message with the public key; instead, you pick a random symmetric (e.g. AES) key, encrypt the symmetric with the public key, and then AES encrypt the message with the symmetric key.

That way, the message expansion is the size of the encrypted symmetric key (which is fixed, independent of message size), and the message expansion caused by the AES encryption (which is tiny, perhaps 16 bytes).

If we estimate that an encrypted symmetric key is about 1kbyte (roughly true for NTRU), then iterating this 10 times with 10 public keys will cause a total expansion of about 10kbytes; certainly tolerable.

And, this can be done postquantum, by using a postquantum symmetric encryption (256 bit keys), and a postquantum public key encryption algorithm (that is, I haven't solved that problem for you...)