I think TOTP should go through private utility methods instead of directly through the public HOTP interface. I don't think it make sense to parametrize HOTP unless we know 3rd parties are deploying HOTP with anything other than SHA1.