Specify how to handle ML-KEM/DSA PKCS8 keys in non-seed-only formats (#34)

- When importing a key in the `expandedKey` format, throw a
  `NotSupportedError`.
- When importing a key in the `both` format, *optionally* throw a
  `NotSupportedError`.
- Alternatively, when importing a key in the `both` format,
  require checking that the seed and expanded key match.

Author: twiss

index.html

@@ -1741,6 +1741,20 @@ <h5>Import Key</h5>
                       {{DataError}}.
                     </p>
                   </li>
+                  <li>
+                    <p>
+                      If |mlKemPrivateKey| represents an ML-KEM key in the `expandedKey` format,
+                      or if |mlKemPrivateKey| represents an ML-KEM key in the `both` format
+                      and the `both` format is not supported, throw a {{NotSupportedError}}.
+                    </p>
+                  </li>
+                  <li>
+                    <p>
+                      If |mlKemPrivateKey| represents an ML-KEM key in the `both` format,
+                      and the `seed` field does not correspond to the `expandedKey` field,
+                      throw a {{DataError}}.
+                    </p>
+                  </li>
                   <li>
                     <p>
                       Let |key| be a new {{CryptoKey}}
@@ -2904,6 +2918,20 @@ <h5>Import Key</h5>
                       {{DataError}}.
                     </p>
                   </li>
+                  <li>
+                    <p>
+                      If |mlDsaPrivateKey| represents an ML-DSA key in the `expandedKey` format,
+                      or if |mlDsaPrivateKey| represents an ML-DSA key in the `both` format
+                      and the `both` format is not supported, throw a {{NotSupportedError}}.
+                    </p>
+                  </li>
+                  <li>
+                    <p>
+                      If |mlDsaPrivateKey| represents an ML-DSA key in the `both` format,
+                      and the `seed` field does not correspond to the `expandedKey` field,
+                      throw a {{DataError}}.
+                    </p>
+                  </li>
                   <li>
                     <p>
                       Let |key| be a new {{CryptoKey}}