Did you know? Deleting a secret key can leave its power behind in a performance cache. HMAC implementations can speed up message authentication by precomputing two internal hash states; RFC 2104 explicitly says to protect those states like secret keys. Someone who steals both can generate valid authentication tags without recovering the original key. Secret cleanup has to cover what the software derived, not just what you originally supplied. #cryptography #cypherpunk