I would be minded to start with a one-shot interface for the sake of simplicity. Then move to a streaming interface once everything is up and running?

That would obviate HpkeSender and HpkeReceiver, and make the methods in trait Hpke something like:

fn open(&self, 
        pk_r: &HpkePublicKey,
        info: &[u8],
        aad; &[u8],
        pt: &[u8],
) -> Result<(EncapsulatedSecret, Vec<u8>), Error>;

Switched to one-shot.

I would be minded to start with a one-shot interface for the sake of simplicity.

Leaving a note here: we do need the non-one-shot interface for ECH: specifically for handling HelloRetryRequests.

Section 6.1.5 "Handshaking with ClientHelloInner" says:

It encrypts EncodedClientHelloInner as described in Section 6.1.1, using the second partial ClientHelloOuterAAD, to obtain a second ClientHelloOuter. It reuses the original HPKE encryption context computed in Section 6.1 and uses the empty string for enc.

The HPKE context maintains a sequence number, so this operation internally uses a fresh nonce for each AEAD operation. Reusing the HPKE context avoids an attack described in Section 10.11.2.

So we specifically need to maintain the HPKE context used for the original client hello so that we can re-use it when creating the updated extension for a HRR response.

I'm trying to bundle up some required changes and will make sure this is one of them.