So, with HmacShA256, this must really be a 256-bit byte array? Is that the reason for the change?

E.g. if the user is using "mybase64256bitkey" for EncryptingCookier, could we just use "mybase64256bitkey" as the secret for the EncryptingCookier's SecureCookier? E.g. the user gets to use the "same key", but technically EncryptingCookier changes it to the 256-bit byte, and SecureCookier says "meh, it's a string, I'll use that with the SHA1".