hex_encode(): canonical counterpart to hex_decode() (the latter is more careful than hex2bin())
consistent uid handling: use 8 bytes == 16 hex digits for signature