Incremental ML-KEM

[ZettaScript]

Signal's ML-KEM Braid protocol needs a variant of ML-KEM where encapsulation is split in two steps.

Would this "incremental ML-KEM" be within the scope of this crate?

Apparently Signal has implemented this protocol using libcrux which supports incremental ML-KEM. https://github.com/signalapp/SparsePostQuantumRatchet/blob/main/src/incremental_mlkem768.rs

[tarcieri]

Yes, we can add it if someone is interested in opening a PR. I guess the API would be based on inherent e.g. pub fn encaps1/encaps2 methods added to EncapsulationKey?

[ZettaScript]

Nice, I will try to make a PR.

I don't know if other KEMs may have the same feature, if not then it makes sense to use direct methods.