Unlike Diffie–Hellman, a KEM is asymmetric in roles: only the key holder's public key is needed, and the sender cannot choose the secret. TLS fits KEMs into its key share model by having the client send an encapsulation key and the server reply with a ciphertext; HPKE (RFC 9180) defines DH-based KEMs (DHKEM) and hybrid post-quantum ones, and RFC 9629 adds KEM recipients to CMS.
Security goal: IND-CCA2, achieved for ML-KEM by the Fujisaki–Okamoto transform. A KEM by itself does not authenticate either side; protocols add signatures or static keys for that. Combining a classical and a post-quantum KEM (as X-Wing and the TLS hybrids do) keeps security if either one holds.