Actually HMAC the tsmac instead of just hashing it

Unless I'm missing something, the `tsmac` is supposed to be a MAC, not a plain digest.