mentioned in: bitcoin#35254

bitcoin#35254 (comment)

"Worth considering as a follow-up, but I'd keep it out of this PR since the chain code lives on the caller side while this PR only touches HMAC.

Btw the snippet doesn't quite work as-is since ChainCode is typedef uint256 in hash.h and pubkey.h, so replacing it with a class derived from base_blob<256> drops the uint8_t and string_view constructors uint256 provides, and breaks call sites that rely on the typedef.
That's a wider refactor which would be another reason it belongs in its own PR. What do you think?" - thomasbuilds