Falcon-512 (category 1) has 897-byte public keys and 666-byte signatures in its padded encoding (at most 752 bytes compressed); Falcon-1024 (category 5) has 1,793-byte public keys and 1,280-byte padded signatures. That is roughly a quarter of ML-DSA's signature size, which matters for certificates, DNSSEC and blockchains.
The difficulty is signing: Falcon samples from a discrete Gaussian using floating-point arithmetic, which is hard to make constant-time and portable, and timing or bias bugs in the sampler can leak the key while still producing valid signatures. In September 2026 NIST's FIPS 206 team proposed a fixed-point signing procedure so that implementations become testable against known answers. Verification uses only integer arithmetic and is fast.
Until FIPS 206 is final, use ML-DSA for approved deployments and treat FN-DSA as a candidate for size-constrained protocols.