A tree of height 10 to 25 gives 2¹⁰ to 2²⁵ signatures per key; the Winternitz parameter trades signature size against speed. Signatures are roughly 1–9 KB and public keys about 60 bytes. HSS (hierarchical signature system) signs lower trees with higher ones to extend capacity. SP 800-208 approves LMS and HSS with SHA-256 and SHAKE256 outputs of 192 or 256 bits, and requires key generation and signing inside hardware modules that cannot export the private state.
Each one-time key must be used only once, so signers must update and persist the state atomically before releasing a signature; a crash, a backup restore or a cloned HSM can cause reuse and enable forgeries. That makes LMS a fit for low-volume, controlled signing such as firmware and boot images (CNSA 2.0 requires LMS or XMSS there, and its FAQ allows only the single-tree forms for national security systems) and a poor fit for general use.