Use HMACs instead of plain SHA1