Salted hashes are not that much better than unsalted hashes, but HMAC itself isn't meaningfully different than just using a salted hash. You have to know the key to complete the hash, just like you have to know the salt in a salted scheme.<p>You know you're getting into trouble with someone's understanding of systems security when you start talking about "secret salts".