The security of hmac is not based strictly on the collision resistance of the hashing function.<p>Oh, and if your HMAC seals over an origin timestamp which your API respects, you&#x27;ve gone and made things even harder.