> holds the HMAC credential over TLS, and have it return true/false And if you're connecting to the original party anyway might as well not even use HMAC or an

> holds the HMAC credential over TLS, and have it return true/false And if you're connecting to the original party anyway might as well not even use HMAC or any crypto at all. When "signed" data needs to be sent to the client don't send it at all, instead store the data locally under a GUID and send that GUID to the client. When client takes their GUID to another party, that other party connects to the original party and retrieves perfectly authentic data. Free bonus - faster client performance. Best crypto is absence of crypto.