The Apple CryptoKit cross-check is a nice sanity test for the seed-to-public-key path, but it only says the KEM output matches, not that the decapsulation side has the same failure behavior or timing properties. For something like ML-KEM, I would still want at least one test around malformed ciphertext handling, since that is where implementations tend to drift.