> The cleanest mitigation is to return results in a canonical order, such as lexicographic sorting.
And hope that the sorting time cannot be used as a side channel.
And hope that the sorting time cannot be used as a side channel.
Because most post-quantum cryptosystems need this primitive.