Switch secret/personalisation during key derivation

This is a slightly better way of doing things, as it removes the possibility of two distinct keys producing the same derived key.  This can happen if the key is `really_long_string` and the alternative key is `sha256(really_long_string)`.  This is pretty unlikely, all told, but it's a trivial change.