hash_hmac is in php since 5.1.2, and as long as we require "php": ">=5.2.4" it isn't needed longer