pub fn hkdf_sha256(secret: &[u8], info: &[u8], salt: &[u8]) -> [u8; 32]
derive a secret from another secret using HKDF-SHA256