Explain the unexplained ML-KEM key-derivation overhead

Explain why key derivation on GET is slower for ML-KEM-768 than for X25519 in the one-worker Python clients, despite identical input lengths and despite manifest size not accounting for the difference.

Background

The authors observed that the key-derivation stage was 4.6 microseconds slower with ML-KEM-768 than with X25519 on both x86 and ARM clients during one-worker GET operations. Because the inputs had the same length and a padded-manifest control exhibited the same effect, manifest size does not explain the discrepancy. The source of this additional key-derivation cost remains unidentified.