No crypto provider is registered

PostQuantumConfig.EnablePostQuantum throws a CryptographicException, or an operation with a PQ part throws an InvalidOperationException:

No ICryptoProvider registered. Call CryptoProviderFactory.RegisterProvider() during startup.
No CryptoProvider registered. Call CryptoProviderFactory.RegisterProvider() or CryptoProviderFactory.SetProvider() during application startup. For Blazor WASM, register WasmCryptoProvider. For Server/Desktop, register NativeCryptoProvider.

• Apps that reference only WKL.System.Security.Cryptography.Core, not WKL.System.Security.Cryptography.Extensions.
• Blazor WebAssembly apps that don't register the WebAssembly provider.

A provider that implements the ICryptoProvider interface computes the PQ algorithms: NativeCryptoProvider with OpenSSL, or WasmCryptoProvider in the browser. If no provider is registered, the library looks for the WKL.System.Security.Cryptography.Extensions assembly on first use and registers its NativeCryptoProvider. If the assembly isn't part of the app, the registration stays empty. In Blazor WebAssembly, that's always the case, because the OpenSSL provider doesn't run in the browser.

• Server and desktop: Reference WKL.System.Security.Cryptography.Extensions. After you publish, check that WKL.System.Security.Cryptography.Extensions.dll sits next to your app. You then don't need to register anything in code.
• Blazor WebAssembly: Register the WebAssembly provider at startup, as described in Use the library in Blazor.
• Your own provider: Register it with CryptoProviderFactory.RegisterProvider(() => …) before you call EnablePostQuantum.