Use Sun provider, not bogus "HmacSHA256", which is NOT a provider. THIS NEEDS TESTING!