`return OpenSSL::HMAC.digest(@sha256, key, user+payload) == signature`