Some consumers may only want "pure" ML-DSA, no pre-hash, external mu etc. Perhaps even, others may only want some utilities such as verify. Could we add configuration options to allow only the selected APIs? or is this something we let the consumer handle?

For the aws-lc import we could reduce unused code by omitting the HashML-DSA modes and associated files, for example.