The part that gets glossed over in a lot of post-quantum messenger designs is that swapping in PQ KEMs usually makes the first few hops more expensive in bandwidth, state, and failure handling, which matters a lot once you also want relay-backed delivery and federation. Pairwise identity continuity sounds close to Signal's safety-number model plus PCS, but if you want that across relays and multiple devices, the ratchet and recovery story gets much harder than the classic X25519 plus double-ratchet setup. So the real tradeoff is not just "post-quantum or not", it is whether you are willing to pay with larger handshakes and more brittle synchronization to keep metadata down. A lot of systems say "metadata reduction" and then quietly reintroduce long-lived server state to make the rest work.

Multi-client codebases force the wire format to be the product, not the app.

if it’s pq messaging, the real question is usually trust bootstrapping, not the kem choice. is there a crisp story for device migration and key compromise recovery?