Ah! I figured out the underlying reason: in the default configuration the PSK isn't per-peer-pair, it's per server. That makes a ton more sense! You get to keep

Ah! I figured out the underlying reason: in the default configuration the PSK isn't per-peer-pair, it's per server. That makes a ton more sense! You get to keep the relatively simple key distribution mechanism, keep identity despite a team-shared PSK (that's what signing solves), and you get PQ resistance. (The problem this addresses is a passive observer who eventually gets a quantum computer, but can't pop any machines to just steal the PSK or whatever.)