switch out straight SHA1 digests for HMACs with a configured key