The ML-DSA implementation in the SUN provider in JDK 24 encodes the private key in its expanded format, as defined in [FIPS 204](https://csrc.nist.gov/pubs/fips/204/final), into its PKCS #8 encoding. This encoding may change as the [related IETF draft](https://datatracker.ietf.org/doc/draft-ietf-lamps-dilithium-certificates/) is not yet finalized.