It's public on HMAC. Is that a bug?