Function install_pq_kx_group 

pub fn install_pq_kx_group() -> PqMode

Prepend the X25519+ML-KEM hybrid key-exchange group to the rustls provider’s kx group list, so the hybrid group is PREFERRED while the classical X25519 group remains as a fallback for non-PQ clients.

This function builds a custom CryptoProvider from the aws-lc-rs default provider with the X25519MLKEM768 hybrid kx group prepended to the kx group list, and installs it as the default provider. The classical X25519 group remains in the list as a fallback, so a client that does not support the hybrid group still completes a classical handshake (rustls’s kx group list is a preference order: the first group the client supports wins).

Returns

PqMode::Enabled when the hybrid kx group was prepended; PqMode::Disabled when the feature is off or the installation failed (a provider was already installed with a different config).