Yes, this is exactly what I'm arguing for. Abstractions like PHP's `password_hash()`. (Note that I disagree that "HMAC-SHA256" qualifies as an abstraction. It'

Yes, this is exactly what I'm arguing for. Abstractions like PHP's `password_hash()`. (Note that I disagree that "HMAC-SHA256" qualifies as an abstraction. It's just more character soup)