Both size_t and the length parameter on CC_SHA1 appear to be unsigned. Seems like we should be limiting to `UINT32_MAX`