derive key in store.sh, use not hmac hash to check integrity