Specify private key format for ML-KEM and ML-DSA when switching to FIPS final versions

[falko-strenzke]

Based on what was announced, NIST' s final standard for the ML-KEM and ML-DSA will enable private keys in seed format. Currently, the draft only refers to the NIST standard for the private key format. Thus this needs more specification, and it might be relevant to specify in the draft:

• what is the single (?) secret key format in the NIST standard, that the draft is referring to
  • alternative option: that seed format is also possible for private keys (?)
• that a private key in expanded format needs to be checked for consistency before usage

[falko-strenzke]

This is relevant only for ML-KEM, since FIPS 204 does not explicitly mention the seed format for the private key.

[falko-strenzke]

LAMPS has decided to use the seed format of the private key format as the transfer format: https://mailarchive.ietf.org/arch/msg/spasm/KPg3lbPeNms2H5PNDBt0iJByuE0/

[falko-strenzke]

It seems that for ML-DSA, Botan will also offer only the seed format: randombit/botan#4270 (comment)