Build on the core we ship ourselves.

pub fn hybrid_encapsulate(
    public_key: &HybridPublicKey,
) -> Result<(HybridCiphertext, HybridSharedSecret), CryptoError> {
    // Generate ephemeral X25519 keypair
    let x25519_ephemeral_secret = x25519_dalek::EphemeralSecret::random_from_rng(OsRng);
    let x25519_ephemeral_public = X25519PublicKey::from(&x25519_ephemeral_secret);

    // Compute X25519 shared secret
    let x25519_shared: SharedSecret = x25519_ephemeral_secret.diffie_hellman(&public_key.x25519);
    reject_non_contributory_x25519(&x25519_shared)?;

    // Encapsulate to ML-KEM public key
    let (kyber_ciphertext, kyber_shared) = public_key.kyber.encapsulate()?;

    // Construct combiner inputs
    let ciphertext = HybridCiphertext {
        x25519_ephemeral: x25519_ephemeral_public,
        kyber_ciphertext,
    };

    // Combine shared secrets using HKDF-SHA512
    let shared_secret = combine_shared_secrets(
        x25519_shared.as_bytes(),
        kyber_shared.as_bytes(),
        &ciphertext,
        public_key,
    )?;

    Ok((ciphertext, shared_secret))
}