Even if it didn’t sha as a hmac is still fine because the length it takes to break. You can’t break sha1 in the time it takes for your packet to go through the hmac step.