fix(3.8): you can't call hmac.new without a digestmod in 3.8

See https://docs.python.org/3/library/hmac.html#hmac.new

Deprecated since version 3.4, removed in version 3.8: MD5 as implicit default digest for digestmod is deprecated. The digestmod parameter is now required. Pass it as a keyword argument to avoid awkwardness when you do not have an initial msg.