Use the elliptic curve version instead https://security.stackexchange.com/questions/46802/what-is-t...

This is built into modern browsers so you can use that as the basis for HMAC if you can't trust TLS or have something like an open URL for a lambda function that in theory should only be hit by someone's webhook (ie. Slack)