Hot channels
Secret and message stay in-page; avoid production keys on shared PCs.
HMAC-SHA256 with Web Crypto (UTF-8 secret and message).
Servers must use the same encoding and byte order when verifying.