PQ keys can't be persisted

X509Store.Add(certificate, CryptoMode.Hybrid) or X509StoreExtensions.PersistPqKeys throws a PlatformNotSupportedException whose message starts with this sentence:

Persisting PQ keys needs the operating system's key store: DPAPI on Windows, the Secret Service (libsecret) on Linux.

The certificate store stays unchanged.

• macOS.
• Linux without Secret Service: servers without a desktop, services without a login session, and containers. Also Linux without the libsecret-1.so.0 and libglib-2.0.so.0 libraries.

The library stores PQ keys next to the certificate store only if an operating system key store protects them. On Windows, that's DPAPI; on Linux, it's the session's Secret Service, such as GNOME Keyring or KWallet. If there isn't one, the library doesn't write a file rather than store the keys unprotected. After the first sentence, the message states exactly what's missing.

• Linux with a desktop: Install the libsecret package, for example libsecret-1-0 on Debian and Ubuntu. Run the process in a session where a Secret Service is running and unlocked.
• Servers, services, and containers: Keep the keys in a PFX file, and import it at startup with X509Certificate2ExportExtensions.ImportPfx. Store the file's password in your secrets management, not in the app itself. See Transfer certificates with PQ keys as PFX files.
• macOS: Use PFX files, as on servers.