pub fn sha256_hex(data: &[u8]) -> String
Lowercase hex SHA-256: how pairing codes (and later session ids) are stored at rest.