On: Why it’s harder to forge a SHA-1 certificate than ...

[KirinDave]

The security of hmac is not based strictly on the collision resistance of the hashing function.

Oh, and if your HMAC seals over an origin timestamp which your API respects, you've gone and made things even harder.