Be clear about HKDF's applicability for password storage