Post-quantum without a prekey server

Going post-quantum usually means parking one-time keys on a server. Our relay is forbidden from holding anything — so both phones derive the starting key instead. How YGOOW's X25519 + ML-KEM-768 hybrid works, and what it costs.