hold KDF output keys as hex, not bitArrays, to facilitate handling