I think that the code is not wrong, it's not a bug, the keymaterial stays the same after appending a extra hash: appending does not change the first bytes. It's not optimal, but ala. Stef Bon