The security of hmac is not based strictly on the collision resistance of the hashing function. Oh, and if your HMAC seals over an origin timestamp which your

The security of hmac is not based strictly on the collision resistance of the hashing function. Oh, and if your HMAC seals over an origin timestamp which your API respects, you've gone and made things even harder.