It might be nice to hide this branch in a helper function, something like:

extension Optional where Wrapped == ContiguousBytes {
    func withUnsafeBytes<ReturnValue>(_ body: (UnsafeRawBufferPointer) throws -> ReturnValue) rethrows -> ReturnValue {
        if let self {
            return try self.withUnsafeBytes { try body($0) }
        } else {
            return try body(UnsafeRawBufferPointer(start: nil, count: 0))
        }
    }
}

This lets us get a single call to MLDSA65_sign which makes this code nicer to follow and ensures we don't mix up arguments.

Would this be ok? (Also using your withUnsafeBytes function)

context.map { Data($0) }.withUnsafeBytes { contextPtr in
    CCryptoBoringSSL_MLDSA65_verify(
        self.pointer,
        signaturePtr.baseAddress,
        signaturePtr.count,
        dataPtr.baseAddress,
        dataPtr.count,
        contextPtr.baseAddress,
        contextPtr.count
    )
}

This needs to be private. It's not acceptable for us to access the raw pointer directly, we need to use a with method to do it.

So should I add a method to PrivateKey.Backing like this one?

func withUnsafePointer<T>(_ body: (UnsafePointer<MLDSA65_private_key>) throws -> T) rethrows -> T {
    try body(self.pointer)
}

We can use the rawRepresentation.regions.count == 1 dance here too, instead of the flatMap.

When I rewrite it like

let bytes: ContiguousBytes = rawRepresentation.regions.count == 1 ? rawRepresentation.regions.first! : Array(rawRepresentation)
try bytes.withUnsafeBytes { buffer in
    var cbs = CBS(data: buffer.baseAddress, len: buffer.count)
    guard CCryptoBoringSSL_MLDSA65_parse_private_key(self.pointer, &cbs) == 1 else {
        throw CryptoKitError.internalBoringSSLError()
    }
}

an error on the CBS init appears, on buffer.baseAddress: Cannot convert value of type 'UnsafeRawPointer?' to expected argument type 'UnsafePointer<UInt8>?' because initializer 'init(data:len:)' was not imported from C header.

Changing it to CBS(data: buffer.baseAddress?.assumingMemoryBound(to: UInt8.self), len: buffer.count) seems to work, is it fine?

It is not, but we don't need it. We want to use a withMemoryRebound(to:) instead. This dance should probably also be wrapped up in a helper function to avoid distracting in the flow here.

I think we can make this a touch more efficient. We can store both of these fields in their useful formats. For the private key, we can just have a var key: MLDSA65_private_key, and then derive pointers as needed.

For the seed, we can use a withUnsafeTemporaryAllocation and then directly create a Data from it. Data is the format we need elsewhere anyway.

This means that we don't need a Backing class?

Technically it does, but we should keep it to avoid us abusing the power of @_implementationOnly.

Same note here, we can store the MLDSA64_public_key directly inline here.

Do we want module here?

I added it just to complete the ML-DSA acronym, maybe I could add an hyphen between it and lattice to make it clearer, as in the FIPS title

I don't think we need an unsafeTemporaryAllocation. We can just zero-initialize the value self.key = .init() and then take a pointer to it.

Got it. I also tried to remove the seed's unsafeTemporaryAllocation by passing to the BoringSSL function an empty [UInt8] var and then initializing the Data object from it, but I encountered some seg faults in testing