Great question — currently FALCON-512 is used for transaction signing only. Node identity and P2P authentication use standard TCP connections without post-quantum authentication at the transport layer, which you're right to flag as a corner being cut.

The roadmap has P2P authentication as a Phase 2 item before public testnet. The plan is to use FALCON-512 for node identity keys as well, so every peer connection is authenticated with post-quantum signatures.

For the current Cori Testnet the threat model assumes honest nodes — which is reasonable for a testnet but not acceptable for mainnet. Full post-quantum P2P authentication is a hard requirement before mainnet launch.

Appreciate you asking the hard question rather than the easy ones.