Okay, but using an encryption library doesn't guarantee your code is free of mistakes either. Just initiating a generic cryptography library requires a certain

Okay, but using an encryption library doesn't guarantee your code is free of mistakes either. Just initiating a generic cryptography library requires a certain amount of specialised knowledge. You have to get the right mode, create a secure key, know how to correctly use an IV or whatever additional parameters the particular encryption algorithm needs. Compared to all that, comparing two HMACs seems relatively straightforward.