iOS 26 quietly added something I had been waiting for: the Secure Enclave can now hold ML-DSA keys.
Not "the app does lattice math and stores a blob in the Keychain". The private key is generated inside the SEP, never leaves it, and every signature is gated by Face ID at the hardware level.
I built a Capacitor plugin on top of it, and the interesting part was not iOS. It was discovering that Android gives you exactly half of what you need, and working out what to do about the other half.
What iOS 26 gives you
CryptoKit now ships SecureEnclave.MLDSA65 and SecureEnclave.MLDSA87, with the same API shape as the long-standing SecureEnclave.P256.Signing.PrivateKey:
