crypto: hmac - require that the underlying hash algorithm is unkeyed