There are 2 problems with DHKEM on PKCS11:

1. DHKEM requires the ability to get the public key from a private key (https://www.rfc-editor.org/rfc/rfc9180.html#section-3-2.4). Back in JDK-8305310, we did this for EC and XDH in the SunEC provider. The function is not available in PKCS #11. Note that there is no XDH support in SunPKCS11 yet.

2. The full Encapsulator.encapsulate and Decapsulator.decapsulate methods accept from and to arguments to return a slice of the shared secrets as the resulting key. However, if the shared secrets are held in an unextractable key, there is currently no way to obtain this slice.