pub fn verify_hmac( key: &SecureKey, message: &[u8], expected_hmac: &[u8], ) -> Result<bool, CryptoError>
Verify HMAC-SHA256 for a message (constant-time comparison)