Original text:
Thus the "confirmed_transcript_hash" field in a GroupContext object represents a transcript over the whole history of MLSPlaintext Commit <del> messages, up to the confirmation field in the current MLSPlaintext message.  The confirmation and signature fields are then included in the transcript for the next epoch.  The interim transcript hash is passed to new members in the GroupInfo struct, and enables existing members to incorporate a Commit message into the transcript without having to store the whole MLSPlaintextCommitAuthData structure. </del>  As shown above, when a new group is created, the "interim_transcript_hash" field is set to the zero-length octet Construct an MLSPlaintext object containing the Commit object. Use the "commit_secret" to advance the key schedule and compute <del> the "confirmation" value in the MLSPlaintext.  Sign the </del>  MLSPlaintext using the current epoch's GroupContext as context. Update the tree in the provisional state by applying the direct Group ID, epoch, tree, confirmed transcript hash, and interim transcript hash from the new state <del> The confirmation from the MLSPlaintext object </del>  Sign the GroupInfo using the member's private signing key and derived secrets for the new epoch. Use the "confirmation_key" for the new epoch to compute the <del> confirmation MAC for this message, as described below, and verify that it is the same as the "confirmation" field in the </del>  MLSPlaintext object. If the above checks are successful, consider the updated GroupContext object as the current state of the group. <del> The confirmation value confirms that the members of the group have arrived at the same state of the group: HMAC RFC2104 uses the Hash algorithm for the ciphersuite in use. </del>  10.2.1. Set the confirmed transcript hash in the new state to the value of the "confirmed_transcript_hash" in the GroupInfo. <del> Verify the confirmation MAC in the GroupInfo using the derived </del>  confirmation key and the "confirmed_transcript_hash" from the GroupInfo.

Reviewer comments:
This PR gets rid of the explicit HMAC reference and uses KDF.Extract instead (which internally uses HMAC). Also is renamed to .
I don't love the extra , but I can live with it.

Revised text:
Thus the "confirmed_transcript_hash" field in a GroupContext object represents a transcript over the whole history of MLSPlaintext Commit  <ins> messages, up to the confirmation tag field in the current MLSPlaintext message.  The confirmation tag and signature fields are then included in the transcript for the next epoch.  The interim transcript hash is passed to new members in the GroupInfo struct, and enables existing members to incorporate a Commit message into the transcript without having to store the whole MLSPlaintextCommitAuthData structure. </ins> As shown above, when a new group is created, the "interim_transcript_hash" field is set to the zero-length octet Construct an MLSPlaintext object containing the Commit object. Use the "commit_secret" to advance the key schedule and compute  <ins> the "confirmation_tag" value in the MLSPlaintext.  Sign the </ins> MLSPlaintext using the current epoch's GroupContext as context. Update the tree in the provisional state by applying the direct Group ID, epoch, tree, confirmed transcript hash, and interim transcript hash from the new state  <ins> The confirmation_tag from the MLSPlaintext object </ins> Sign the GroupInfo using the member's private signing key and derived secrets for the new epoch. Use the "confirmation_key" for the new epoch to compute the  <ins> confirmation tag for this message, as described below, and verify that it is the same as the "confirmation_tag" field in the </ins> MLSPlaintext object. If the above checks are successful, consider the updated GroupContext object as the current state of the group.  <ins> The confirmation tag value confirms that the members of the group have arrived at the same state of the group: </ins> 10.2.1. Set the confirmed transcript hash in the new state to the value of the "confirmed_transcript_hash" in the GroupInfo.  <ins> Verify the confirmation tag in the GroupInfo using the derived </ins> confirmation key and the "confirmed_transcript_hash" from the GroupInfo.