This is a change to the API then: `CMAC.update()` is defined as taking a byte string only, not a byte array. I find this belongs to a separate change set: this PR is about removing support for Python<2.6 (and adding support for buffers in the process).