Replace hmac() with digest_random() so we'll get a safe random key.