I did not suggest "rolling your own crypto". HMAC is detailed in an RFC (http://tools.ietf.org/html/rfc2104 http://tools.ietf.org/html/rfc2104), is widely used,

I did not suggest "rolling your own crypto". HMAC is detailed in an RFC (http://tools.ietf.org/html/rfc2104 http://tools.ietf.org/html/rfc2104), is widely used, e.g. Amazon AWS, and is part of OpenSSL. At no point do you have to "roll your own". If you don't implement this correctly the request will simply fail, the credentials won't be exposed at any point. Please spare me the FUD.