FWIW, I tested this native HMAC-SHA256 against the Web Crypto API to confirm they give the same results for random messages & keys and the signatures matched. I can’t guarantee there aren’t special cases where they diverge, but I’m satisfied enough to use it in production. 