Completely re-write so it's no longer a complete embarrassment. It's now a thin wrapper around OpenSSL::HMAC.