Using XMSS with Blake2 Since XMSS only requires a 2nd preimage resistant hash function, is using Blake2 in XMSS possible? It is not in standard, but Blake2 seems to be faster than SHA256
It's definitely possible, but the standard needs some amendment to make it formal.
It's interesting to know that, KangarooTwelve is even faster, but nonetheless, not yet formallized.
Also that NIST intends approve SHAKE XOFs as MGF in RSA in FIPS 186-5, but not yet included in PKCS#1