Using Lattice-based cryptography for TLS\SSL Given the general benefits of Lattice-based cryptography, such as:


Post quantum Security
Security from worst case scenario
Efficiency


What could the outlook of shifting from RSA \ ECC-based cryptography to the Lattice one (say NTRU) be?

Would that be feasible? 

Are there any drawbacks?
Feasible? Sure, there are lattice algorithms that are competitive in performance with RSA.

However, there are drawbacks, like:


They've been studied less than RSA or ECC, especially the individual algorithms.
The most well studied system, NTRU, is patented.
No generic proof that I know of that there isn't a quantum algorithm to solve them.


The first one is why I doubt TLS will quickly move to lattices at least unless there's significant evidence that a quantum computer capable of breaking current crypto is practical. The third means that even then another public key system might be better, if such can be found.