Ah.  I cloned the code from django.utils.crypto.py, which uses sha1 for both constructing a key value and encoding the message.  This code uses sha1 to construct the key that gets passed to the hmac.new call, but the actual output of the hmac is md5 by default.  I could make it more explicit by specifying digestmod=hashlib.md5, rather than relying on the default.  And I could use md5 for creating the key value as well, but I don't really understand the implications of that, so I thought it better to change less.