Post-quantum first
The registry is the design
Algorithms resolve through an OID-keyed registry: OID to parameters to key import to sign/verify. No format module hardcodes an algorithm switch, so adding an algorithm is a data row plus a signer -- not a special case threaded through every parser. That is what keeps classical and post-quantum algorithms structurally equal: the certificate, CMS, and timestamping paths do not know which family they are verifying.
Native crypto only
The cryptography runs on Node's built-in node:crypto -- classical and FIPS post-quantum both. The toolkit ships zero npm runtime dependencies and vendors no cryptographic code, so the crypto you run is the crypto your Node runtime ships and patches.
No classical-only defaults
Where a post-quantum or hybrid option exists, the toolkit does not default to a classical-only choice. Operators migrating ahead of the quantum transition should not have to fight their PKI library's defaults to get there.