actually run those hmacs, from cryptokit