The way to think about HPKE is really as a primitive building block for use in other protocols, rather than as a protocol on its own. For example, in TLS Encry

The way to think about HPKE is really as a primitive building block for use in other protocols, rather than as a protocol on its own. For example, in TLS Encrypted Client Hello (ECH) [0], the server publishes a public key which is then used by the client to encrypt the ClientHello message. That encryption is performed using HPKE. Similarly, MLS uses HPKE as part of its inner core. [0] https://datatracker.ietf.org/doc/draft-ietf-tls-esni/ https://datatracker.ietf.org/doc/draft-ietf-tls-esni/