Advantages and disadvantages of hash-based signatures We know hash-based signatures (Winternitz signature, HORS(T) signature) that are quantum-safe and efficient. They can be stateful or stateless, one-time or multiple-time. But why are they not widely used in practice? Or maybe they are, please tell me some applications, advantages and disadvantages.
This table—of Ed25519 vs. the lattice-based post-quantum candidate Dilithium vs. SPHINCS+ variants at a comparable post-quantum security level, with a tradeoff between signature size and signing time—may help explain:

\begin{equation*}
\begin{array}{r|rr|rr|rr}
\text{sig scheme} &amp;&amp; \text{sig bytes} &amp;&amp; \text{cycles to sign} \\
\hline
\text{ed25519}
  &amp; \times1= &amp; 64
  &amp; \times1= &amp; 45\,400 \\
\text{dilithium3}
  &amp; \times42= &amp; 2\,701
  &amp; \times101= &amp; 4\,600\,060 \\
\text{sphincss192sha256simple}
  &amp; \times266= &amp; 17\,064
  &amp; \times46\,000= &amp; 2\,105\,269\,820 \\
\text{sphincsf192sha256simple}
  &amp; \times557= &amp; 35\,664
  &amp; \times1\,850= &amp; 84\,025\,740
\end{array}
\end{equation*}

Median cycle counts taken from SUPERCOP measurements on a 2019 AMD EPYC 7702 with 64 x 2000MHz cores; see the full results https://bench.cr.yp.to/results-sign.html for more details, comparisons on different machines, and additional signature schemes.

Although hash-based signatures are reasonably well-understood and based on conservative design principles, they are thousands of times costlier than the modern standard for signatures secure against a classical adversary, the elliptic-curve signature scheme Ed25519, and hundreds of times larger.  (That said, the verification costs of SPHINCS+ aren't quite so bad.)

The stateful signature scheme XMSS has been deployed in OpenSSH, which is a little silly because (a) stateful signatures are a serious foot-gun for operators, and (b) there's no need to deploy post-quantum online authentication mechanisms for a long time—it is only important to deploy them once quantum computers are becoming a serious threat so that future sessions cannot be forged by a quantum adversary.

(In contrast, post-quantum encryption and post-quantum key agreement are important to deploy as soon as possible—and OpenSSH is experimenting with that too—to prevent a future quantum computer from retroactively decrypting past sessions.)