There are 3 sections in the security guide that list JCE service classes that require signing the security provider.

Step 1.1: Consider Additional JCA Provider Requirements and Recommendations for Encryption Implementations
https://docs.oracle.com/en/java/javase/21/security/howtoimplaprovider.html#GUID-AEE5234F-24F1-4899-B490-C79F0C2D8D59

Step 7: Sign Your JAR File, If Necessary
https://docs.oracle.com/en/java/javase/21/security/howtoimplaprovider.html#GUID-2D4432F9-1C3C-4A91-8612-2B2840188B36

Step 7.2: Sign Your Provider
https://docs.oracle.com/en/java/javase/21/security/howtoimplaprovider.html#GUID-CF5F0E7D-BA0E-494C-8A5A-B228FF839AEF

The current list only contains Cipher, KeyAgreement, KeyGenerator, MAC, and SecretKey factory. Please add "KEM" to the list.

Also, the following sections list all JCA/JCE services classes. Add KEM (or KEMSpi) into the lists:

Engine Classes and Corresponding Service Provider Interface Classes:
https://docs.oracle.com/en/java/javase/21/security/howtoimplaprovider.html#GUID-B35E3749-0A12-42C3-BA0B-C444D7E140BB

Step 1: Write your Service Implementation Code
https://docs.oracle.com/en/java/javase/21/security/howtoimplaprovider.html#GUID-1D2FDA77-743C-47CB-9CCB-2585FEC0607A

Step 3.1: Create a Provider That Uses String Objects to Register Its Services
https://docs.oracle.com/en/java/javase/21/security/howtoimplaprovider.html#GUID-AB9C2460-0CF2-48BA-B9FE-7059071344CE