Sizes in bytes (FIPS 204 Table 2), public key / signature: ML-DSA-44 1,312 / 2,420 (security category 2), ML-DSA-65 1,952 / 3,309 (category 3), ML-DSA-87 2,592 / 4,627 (category 5). Private keys are 2,560–4,896 bytes expanded, but can be stored as the 32-byte seed. On one Apple M4 Max core OpenSSL 3.6.5 makes about 3,900 ML-DSA-44 signatures and 20,800 verifications per second; signing uses rejection sampling, so its time varies.
Signing is hedged by default: 32 bytes of fresh randomness are mixed with key and message, and an optional deterministic variant uses zeros instead (§3.4). Every signature binds a context string of up to 255 bytes. HashML-DSA (§5.4) signs a digest with the hash OID bound in, as a distinct algorithm. X.509 identifiers are id-ml-dsa-44, -65 and -87 (2.16.840.1.101.3.4.3.17 to .19, RFC 9881).
ML-DSA is the default choice for general post-quantum signing: certificates in private PKIs, firmware, documents. Its size is the obstacle for TLS in the public web PKI, which is why composite ML-DSA certificates and Merkle Tree Certificates are being designed. The PQ signatures tool signs and verifies locally.