I'd recommend passing Buffers around as much as possible, rather than switching between Strings and Buffers. My concern is the opportunity for encoding problems, especially multiple code paths that might not encode things exactly the same way. Maybe `keyStretch.derive()` could take an `emailBuf`, and we could skip the `toString` here?