Authentication is safer than encryption, because harvest-now-decrypt-later is not available. Currently PQ is not standardized for passkeys, and at least Firefox fails if the authenticator advertises unknown algorithms.