diff --git a/Cargo.lock b/Cargo.lock
index 8eb1b3d..f5b733e 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -33,9 +33,9 @@ dependencies = [
 
 [[package]]
 name = "aes"
-version = "0.8.3"
+version = "0.8.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "ac1f845298e95f983ff1944b728ae08b8cebab80d684f0a832ed0fc74dfa27e2"
+checksum = "b169f7a6d4742236a0a00c541b845991d0ac43e546831af1249753ab4c3aa3a0"
 dependencies = [
  "cfg-if",
  "cipher",
@@ -44,9 +44,9 @@ dependencies = [
 
 [[package]]
 name = "aho-corasick"
-version = "1.0.2"
+version = "1.1.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "43f6cb1bf222025340178f382c426f13757b2960e89779dfcb319c32542a5a41"
+checksum = "b2969dcb958b36655471fc61f7e416fa76033bdd4bfed0678d8fee1e2d07a1f0"
 dependencies = [
  "memchr",
 ]
@@ -64,9 +64,9 @@ dependencies = [
 
 [[package]]
 name = "atomic-polyfill"
-version = "0.1.11"
+version = "1.0.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "e3ff7eb3f316534d83a8a2c3d1674ace8a5a71198eba31e2e2b597833f699b28"
+checksum = "8cf2bce30dfe09ef0bfaef228b9d414faaf7e563035494d7fe092dba54b300f4"
 dependencies = [
  "critical-section",
 ]
@@ -121,9 +121,9 @@ checksum = "bef38d45163c2f1dde094a7dfd33ccf595c92905c8f8f4fdc18d06fb1037718a"
 
 [[package]]
 name = "bitflags"
-version = "2.4.1"
+version = "2.4.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "327762f6e5a765692301e5bb513e0d9fef63be86bbc14528052b1cd3e6f03e07"
+checksum = "ed570934406eb16438a4e976b1b4500774099c13b8cb96eec99f620f05090ddf"
 
 [[package]]
 name = "block-buffer"
@@ -154,9 +154,9 @@ dependencies = [
 
 [[package]]
 name = "byteorder"
-version = "1.4.3"
+version = "1.5.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "14c189c53d098945499cdfa7ecc63567cf3886b3332b312a5b4585d8d3a6a610"
+checksum = "1fd0f2584146f6f2ef48085050886acf353beff7305ebd1ae69500e27c67f64b"
 
 [[package]]
 name = "cbc"
@@ -181,12 +181,9 @@ dependencies = [
 
 [[package]]
 name = "cc"
-version = "1.0.80"
+version = "1.0.89"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "51f1226cd9da55587234753d1245dd5b132343ea240f26b6a9003d68706141ba"
-dependencies = [
- "libc",
-]
+checksum = "a0ba8f7aaa012f30d5b2861462f6708eccd49c3c39863fe083a308035f63d723"
 
 [[package]]
 name = "cexpr"
@@ -240,9 +237,9 @@ dependencies = [
 
 [[package]]
 name = "clang-sys"
-version = "1.6.1"
+version = "1.7.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "c688fc74432808e3eb684cae8830a86be1d66a2bd58e1f248ed0960a590baf6f"
+checksum = "67523a3b4be3ce1989d607a828d036249522dd9c1c8de7f4dd2dae43a37369d1"
 dependencies = [
  "glob",
  "libc",
@@ -268,9 +265,9 @@ dependencies = [
 
 [[package]]
 name = "clap-num"
-version = "1.0.2"
+version = "1.1.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "488557e97528174edaa2ee268b23a809e0c598213a4bbcb4f34575a46fda147e"
+checksum = "0e063d263364859dc54fb064cedb7c122740cd4733644b14b176c097f51e8ab7"
 dependencies = [
  "num-traits",
 ]
@@ -299,9 +296,9 @@ dependencies = [
 
 [[package]]
 name = "const-oid"
-version = "0.9.4"
+version = "0.9.6"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "795bc6e66a8e340f075fcf6227e417a2dc976b92b91f3cdc778bb858778b6747"
+checksum = "c2459377285ad874054d797f3ccebf984978aa39129f6eafde5cdc8315b612f8"
 
 [[package]]
 name = "cosey"
@@ -316,18 +313,18 @@ dependencies = [
 
 [[package]]
 name = "cpufeatures"
-version = "0.2.9"
+version = "0.2.12"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "a17b76ff3a4162b0b27f354a0c87015ddad39d35f9c0c36607a3bdd175dde1f1"
+checksum = "53fe5e26ff1b7aef8bca9c6080520cfb8d9333c7568e1829cef191a9723e5504"
 dependencies = [
  "libc",
 ]
 
 [[package]]
 name = "critical-section"
-version = "1.1.1"
+version = "1.1.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "6548a0ad5d2549e111e1f6a11a6c2e2d00ce6a3dafe22948d67c2b443f775e52"
+checksum = "7059fff8937831a9ae6f0fe4d658ffabf58f2ca96aa9dec1c889f936f705f216"
 
 [[package]]
 name = "crypto-bigint"
@@ -409,9 +406,9 @@ checksum = "b365fabc795046672053e29c954733ec3b05e4be654ab130fe8f1f94d7051f35"
 
 [[package]]
 name = "delog"
-version = "0.1.6"
+version = "0.1.7"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "4cd67f90cc14e0a91cf693141453cccf2b74db9d59c40f6be18b79169fe77dfd"
+checksum = "af2b93368262340c9d4441251b824500d1b641a50957ecf4219a2cc41b9eac8f"
 dependencies = [
  "log",
 ]
@@ -496,7 +493,7 @@ version = "2.2.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "115531babc129696a58c64a4fef0a8bf9e9698629fb97e9e40767d235cfbcd53"
 dependencies = [
- "signature 2.1.0",
+ "signature 2.2.0",
 ]
 
 [[package]]
@@ -570,16 +567,16 @@ dependencies = [
  "serde",
  "serde-indexed",
  "serde_cbor",
- "sha2 0.10.7",
+ "sha2 0.10.8",
  "trussed",
  "trussed-hkdf",
 ]
 
 [[package]]
 name = "flexiber"
-version = "0.1.0"
+version = "0.1.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "e3df5b1466eec7b03f5848d8388b99975a0ba1a26510db61ba87c2a6177938e5"
+checksum = "f72c28a2ada3f3db32168659a9322b13e88bced18d8c9e5aeb217e56515cffce"
 dependencies = [
  "delog",
  "flexiber_derive",
@@ -640,9 +637,9 @@ dependencies = [
 
 [[package]]
 name = "half"
-version = "1.8.2"
+version = "1.8.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "eabb4a44450da02c90444cf74558da904edde8fb4e9035a9a6a4e15445af0bd7"
+checksum = "1b43ede17f21864e81be2fa654110bf1e793774238d86ef8555c37e6519c0403"
 
 [[package]]
 name = "hash32"
@@ -661,9 +658,9 @@ checksum = "8a9ee70c43aaf417c914396645a0fa852624801b24ebb7ae78fe8272889ac888"
 
 [[package]]
 name = "heapless"
-version = "0.7.16"
+version = "0.7.17"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "db04bc24a18b9ea980628ecf00e6c0264f3c1426dac36c00cb49b6fbad8b0743"
+checksum = "cdc6457c0eb62c71aac4bc17216026d8410337c4126773b9c5daba343f17964f"
 dependencies = [
  "atomic-polyfill",
  "hash32",
@@ -708,9 +705,9 @@ checksum = "6fe2267d4ed49bc07b63801559be28c718ea06c4738b7a03c94df7386d2cde46"
 
 [[package]]
 name = "hkdf"
-version = "0.12.3"
+version = "0.12.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "791a029f6b9fc27657f6f188ec6e5e43f6911f6f878e0dc5501396e09809d437"
+checksum = "7b5f8eb2ad728638ea2c7d47a21db23b7b58a72ed6a38256b8a1849f15fbbdf7"
 dependencies = [
  "hmac 0.12.1",
 ]
@@ -798,25 +795,25 @@ checksum = "830d08ce1d1d941e6b30645f1a0eb5643013d835ce3779a5fc208261dbe10f55"
 
 [[package]]
 name = "libc"
-version = "0.2.147"
+version = "0.2.153"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "b4668fb0ea861c1df094127ac5f1da3409a82116a4ba74fca2e58ef927159bb3"
+checksum = "9c198f91728a82281a64e1f4f9eeb25d82cb32a5de251c6bd1b5154d63a8e7bd"
 
 [[package]]
 name = "libloading"
-version = "0.7.4"
+version = "0.8.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "b67380fd3b2fbe7527a606e18729d21c6f3951633d0500574c4dc22d2d638b9f"
+checksum = "2caa5afb8bf9f3a2652760ce7d4f62d21c4d5a423e68466fca30df82f2330164"
 dependencies = [
  "cfg-if",
- "winapi",
+ "windows-targets 0.52.4",
 ]
 
 [[package]]
 name = "libm"
-version = "0.2.7"
+version = "0.2.8"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "f7012b1bbb0719e1097c47611d3898568c546d597c2e74d66f6087edd5233ff4"
+checksum = "4ec2a862134d2a7d32d7983ddcdd1c4923530833c9f2ea1a44fc5fa473989058"
 
 [[package]]
 name = "littlefs2"
@@ -846,9 +843,9 @@ dependencies = [
 
 [[package]]
 name = "lock_api"
-version = "0.4.10"
+version = "0.4.11"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "c1cc9717a20b1bb222f333e6a92fd32f7d8a18ddc5a3191a11af45dcbf4dcd16"
+checksum = "3c168f8615b12bc01f9c17e2eb0cc07dcae1940121185446edc3744920e8ef45"
 dependencies = [
  "autocfg",
  "scopeguard",
@@ -856,9 +853,9 @@ dependencies = [
 
 [[package]]
 name = "log"
-version = "0.4.19"
+version = "0.4.21"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "b06a4cde4c0f271a446782e3eff8de789548ce57dbc8eca9292c27f4a42004b4"
+checksum = "90ed8c1e510134f979dbc4f070f87d4313098b704861a105fe34231c70a3901c"
 
 [[package]]
 name = "loom"
@@ -884,9 +881,9 @@ dependencies = [
 
 [[package]]
 name = "memchr"
-version = "2.5.0"
+version = "2.7.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "2dffe52ecf27772e601905b7522cb4ef790d2cc203488bbd0e2fe85fcb74566d"
+checksum = "523dc4f511e55ab87b694dc30d0f820d60906ef06413f93d4d7a1385599cc149"
 
 [[package]]
 name = "nb"
@@ -964,19 +961,18 @@ dependencies = [
 
 [[package]]
 name = "num-integer"
-version = "0.1.45"
+version = "0.1.46"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "225d3389fb3509a24c93f5c29eb6bde2586b98d9f016636dff58d7c6f7569cd9"
+checksum = "7969661fd2958a5cb096e56c8e1ad0444ac2bbcd0061bd28660485a44879858f"
 dependencies = [
- "autocfg",
  "num-traits",
 ]
 
 [[package]]
 name = "num-iter"
-version = "0.1.43"
+version = "0.1.44"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "7d03e6c028c5dc5cac6e2dec0efda81fc887605bb3d884578bb6d6bf7514e252"
+checksum = "d869c01cc0c455284163fd0092f1f93835385ccab5a98a0dcc497b2f8bf055a9"
 dependencies = [
  "autocfg",
  "num-integer",
@@ -996,9 +992,9 @@ dependencies = [
 
 [[package]]
 name = "num-traits"
-version = "0.2.16"
+version = "0.2.18"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "f30b0abd723be7e2ffca1272140fac1a2f084c77ec3e123c192b66af1ee9e6c2"
+checksum = "da0df0e5185db44f69b44f26786fe401b6c293d1907744beaa7fa62b2e5a517a"
 dependencies = [
  "autocfg",
  "libm",
@@ -1006,21 +1002,21 @@ dependencies = [
 
 [[package]]
 name = "once_cell"
-version = "1.18.0"
+version = "1.19.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "dd8b5dd2ae5ed71462c540258bedcb51965123ad7e7ccf4b9a8cafaa4a63576d"
+checksum = "3fdb12b2476b595f9358c5161aa467c2438859caa136dec86c26fdd2efe17b92"
 
 [[package]]
 name = "opaque-debug"
-version = "0.3.0"
+version = "0.3.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "624a8340c38c1b80fd549087862da4ba43e08858af025b236e509b6649fc13d5"
+checksum = "c08d65885ee38876c4f86fa503fb49d7b507c2b62552df7c70b2fce627e06381"
 
 [[package]]
 name = "os_str_bytes"
-version = "6.5.1"
+version = "6.6.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "4d5d9eb14b174ee9aa2ef96dc2b94637a2d4b6e7cb873c7e171f0c20c6cf3eac"
+checksum = "e2355d85b9a3786f481747ced0e0ff2ba35213a1f9bd406ed906554d7af805a1"
 
 [[package]]
 name = "overload"
@@ -1073,9 +1069,9 @@ checksum = "19b17cddbe7ec3f8bc800887bab5e717348c95ea2ca0b1bf0837fb964dc67099"
 
 [[package]]
 name = "pin-project-lite"
-version = "0.2.10"
+version = "0.2.13"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "4c40d25201921e5ff0c862a505c6557ea88568a4e3ace775ab55e93f2f4f9d57"
+checksum = "8afb450f006bf6385ca15ef45d71d2288452bc3683ce2e2cacc0d18e4be60b58"
 
 [[package]]
 name = "pkcs1"
@@ -1169,9 +1165,9 @@ dependencies = [
 
 [[package]]
 name = "proc-macro2"
-version = "1.0.66"
+version = "1.0.78"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "18fb31db3f9bddb2ea821cde30a9f70117e3f119938b5ee630b7403aa6e2ead9"
+checksum = "e2422ad645d89c99f8f3e6b88a9fdeca7fabeac836b1002371c4367c8f984aae"
 dependencies = [
  "unicode-ident",
 ]
@@ -1184,9 +1180,9 @@ checksum = "a1d01941d82fa2ab50be1e79e6714289dd7cde78eba4c074bc5a4374f650dfe0"
 
 [[package]]
 name = "quote"
-version = "1.0.32"
+version = "1.0.35"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "50f3b39ccfb720540debaa0164757101c08ecb8d326b15358ce76a62c7e85965"
+checksum = "291ec9ab5efd934aaf503a6466c5d5251535d108ee747472c3977cc5acc868ef"
 dependencies = [
  "proc-macro2",
 ]
@@ -1225,14 +1221,14 @@ checksum = "09c30c54dffee5b40af088d5d50aa3455c91a0127164b51f0215efc4cb28fb3c"
 
 [[package]]
 name = "regex"
-version = "1.9.1"
+version = "1.10.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "b2eae68fc220f7cf2532e4494aded17545fce192d59cd996e0fe7887f4ceb575"
+checksum = "b62dbe01f0b06f9d8dc7d49e05a0785f153b00b2c227856282f671e0318c9b15"
 dependencies = [
  "aho-corasick",
  "memchr",
- "regex-automata 0.3.4",
- "regex-syntax 0.7.4",
+ "regex-automata 0.4.6",
+ "regex-syntax 0.8.2",
 ]
 
 [[package]]
@@ -1246,13 +1242,13 @@ dependencies = [
 
 [[package]]
 name = "regex-automata"
-version = "0.3.4"
+version = "0.4.6"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "b7b6d6190b7594385f61bd3911cd1be99dfddcfc365a4160cc2ab5bff4aed294"
+checksum = "86b83b8b9847f9bf95ef68afb0b8e6cdb80f498442f5179a29fad448fcc1eaea"
 dependencies = [
  "aho-corasick",
  "memchr",
- "regex-syntax 0.7.4",
+ "regex-syntax 0.8.2",
 ]
 
 [[package]]
@@ -1263,9 +1259,9 @@ checksum = "f162c6dd7b008981e4d40210aca20b4bd0f9b60ca9271061b07f78537722f2e1"
 
 [[package]]
 name = "regex-syntax"
-version = "0.7.4"
+version = "0.8.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "e5ea92a5b6195c6ef2a0295ea818b312502c6fc94dde986c5553242e18fd4ce2"
+checksum = "c08c74e62047bb2de4ff487b251e4a92e24f48745648451635cec7d591162d9f"
 
 [[package]]
 name = "rsa"
@@ -1282,8 +1278,8 @@ dependencies = [
  "pkcs1",
  "pkcs8",
  "rand_core",
- "sha2 0.10.7",
- "signature 2.1.0",
+ "sha2 0.10.8",
+ "signature 2.2.0",
  "subtle",
  "zeroize",
 ]
@@ -1335,15 +1331,15 @@ checksum = "94143f37725109f92c262ed2cf5e59bce7498c01bcc1502d7b9afe439a4e9f49"
 
 [[package]]
 name = "semver"
-version = "1.0.18"
+version = "1.0.22"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "b0293b4b29daaf487284529cc2f5675b8e57c61f70167ba415a463651fd6a918"
+checksum = "92d43fe69e652f3df9bdc2b85b2854a0825b86e4fb76bc44d945137d053639ca"
 
 [[package]]
 name = "serde"
-version = "1.0.180"
+version = "1.0.197"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "0ea67f183f058fe88a4e3ec6e2788e003840893b91bac4559cabedd00863b3ed"
+checksum = "3fb1c873e1b9b056a4dc4c0c198b24c3ffa059243875552b2bd0933b1aee4ce2"
 dependencies = [
  "serde_derive",
 ]
@@ -1364,14 +1360,14 @@ source = "git+https://github.com/sosthene-nitrokey/serde-indexed.git?rev=5005d23
 dependencies = [
  "proc-macro2",
  "quote",
- "syn 2.0.28",
+ "syn 2.0.52",
 ]
 
 [[package]]
 name = "serde_bytes"
-version = "0.11.12"
+version = "0.11.14"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "ab33ec92f677585af6d88c65593ae2375adde54efdbf16d597f2cbc7a6d368ff"
+checksum = "8b8497c313fd43ab992087548117643f6fcd935cbf36f176ffda0aacf9591734"
 dependencies = [
  "serde",
 ]
@@ -1388,24 +1384,24 @@ dependencies = [
 
 [[package]]
 name = "serde_derive"
-version = "1.0.180"
+version = "1.0.197"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "24e744d7782b686ab3b73267ef05697159cc0e5abbed3f47f9933165e5219036"
+checksum = "7eb0b34b42edc17f6b7cac84a52a1c5f0e1bb2227e997ca9011ea3dd34e8610b"
 dependencies = [
  "proc-macro2",
  "quote",
- "syn 2.0.28",
+ "syn 2.0.52",
 ]
 
 [[package]]
 name = "serde_repr"
-version = "0.1.16"
+version = "0.1.18"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "8725e1dfadb3a50f7e5ce0b1a540466f6ed3fe7a0fca2ac2b8b831d31316bd00"
+checksum = "0b2e6b945e9d3df726b65d6ee24060aff8e3533d431f677a9695db04eff9dfdb"
 dependencies = [
  "proc-macro2",
  "quote",
- "syn 2.0.28",
+ "syn 2.0.52",
 ]
 
 [[package]]
@@ -1434,9 +1430,9 @@ dependencies = [
 
 [[package]]
 name = "sha2"
-version = "0.10.7"
+version = "0.10.8"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "479fb9d862239e610720565ca91403019f2f00410f1864c5aa7479b950a76ed8"
+checksum = "793db75ad2bcafc3ffa7c68b215fee268f537982cd901d132f89c6343f3a3dc8"
 dependencies = [
  "cfg-if",
  "cpufeatures",
@@ -1445,9 +1441,9 @@ dependencies = [
 
 [[package]]
 name = "sharded-slab"
-version = "0.1.4"
+version = "0.1.7"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "900fba806f70c630b0a382d0d825e17a0f19fcd059a2ade1ff237bcddf446b31"
+checksum = "f40ca3c46823713e0d4209592e8d6e826aa57e928f09752619fc696c499637f6"
 dependencies = [
  "lazy_static",
 ]
@@ -1470,9 +1466,9 @@ dependencies = [
 
 [[package]]
 name = "signature"
-version = "2.1.0"
+version = "2.2.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "5e1788eed21689f9cf370582dfc467ef36ed9c707f073528ddafa8d83e3b8500"
+checksum = "77549399552de45a898a580c1b41d445bf730df867cc44e6c0233bbc4b8329de"
 dependencies = [
  "digest 0.10.7",
  "rand_core",
@@ -1480,9 +1476,9 @@ dependencies = [
 
 [[package]]
 name = "smallvec"
-version = "1.11.0"
+version = "1.13.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "62bb4feee49fdd9f707ef802e22365a35de4b7b299de4763d44bfea899442ff9"
+checksum = "e6ecd384b10a64542d77071bd64bd7b231f4ed5940fba55e98c3de13824cf3d7"
 
 [[package]]
 name = "spin"
@@ -1531,7 +1527,7 @@ dependencies = [
  "proc-macro2",
  "quote",
  "rustversion",
- "syn 2.0.28",
+ "syn 2.0.52",
 ]
 
 [[package]]
@@ -1553,9 +1549,9 @@ dependencies = [
 
 [[package]]
 name = "syn"
-version = "2.0.28"
+version = "2.0.52"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "04361975b3f5e348b2189d8dc55bc942f278b2d482a6a0365de5bdd62d351567"
+checksum = "b699d15b36d1f02c3e7c69f8ffef53de37aefae075d8488d4ba1a7788d574a07"
 dependencies = [
  "proc-macro2",
  "quote",
@@ -1576,24 +1572,24 @@ dependencies = [
 
 [[package]]
 name = "termcolor"
-version = "1.2.0"
+version = "1.4.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "be55cf8942feac5c765c2c993422806843c9a9a45d4d5c407ad6dd2ea95eb9b6"
+checksum = "06794f8f6c5c898b3275aebefa6b8a1cb24cd2c6c79397ab15774837a0bc5755"
 dependencies = [
  "winapi-util",
 ]
 
 [[package]]
 name = "textwrap"
-version = "0.16.0"
+version = "0.16.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "222a222a5bfe1bba4a77b45ec488a741b3cb8872e5e499451fd7d0129c9c7c3d"
+checksum = "23d434d3f8967a09480fb04132ebe0a3e088c173e6d0ee7897abbdf4eab0f8b9"
 
 [[package]]
 name = "thread_local"
-version = "1.1.7"
+version = "1.1.8"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "3fdd6f064ccff2d6567adcb3873ca630700f00b5ad3f060c25b5dcfd9a4ce152"
+checksum = "8b9ef9bad013ada3808854ceac7b46812a6465ba368859a37e2100283d2d719c"
 dependencies = [
  "cfg-if",
  "once_cell",
@@ -1601,11 +1597,10 @@ dependencies = [
 
 [[package]]
 name = "tracing"
-version = "0.1.37"
+version = "0.1.40"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "8ce8c33a8d48bd45d624a6e523445fd21ec13d3653cd51f681abf67418f54eb8"
+checksum = "c3523ab5a71916ccf420eebdf5521fcef02141234bbc0b8a49f2fdc4544364ef"
 dependencies = [
- "cfg-if",
  "pin-project-lite",
  "tracing-attributes",
  "tracing-core",
@@ -1613,20 +1608,20 @@ dependencies = [
 
 [[package]]
 name = "tracing-attributes"
-version = "0.1.26"
+version = "0.1.27"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "5f4f31f56159e98206da9efd823404b79b6ef3143b4a7ab76e67b1751b25a4ab"
+checksum = "34704c8d6ebcbc939824180af020566b01a7c01f80641264eba0999f6c2b6be7"
 dependencies = [
  "proc-macro2",
  "quote",
- "syn 2.0.28",
+ "syn 2.0.52",
 ]
 
 [[package]]
 name = "tracing-core"
-version = "0.1.31"
+version = "0.1.32"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "0955b8137a1df6f1a2e9a37d8a6656291ff0297c1a97c24e0d8425fe2312f79a"
+checksum = "c06d3da6113f116aaee68e4d601191614c9053067f9ab7f6edbcb161237daa54"
 dependencies = [
  "once_cell",
  "valuable",
@@ -1634,20 +1629,20 @@ dependencies = [
 
 [[package]]
 name = "tracing-log"
-version = "0.1.3"
+version = "0.2.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "78ddad33d2d10b1ed7eb9d1f518a5674713876e97e5bb9b7345a7984fbb4f922"
+checksum = "ee855f1f400bd0e5c02d150ae5de3840039a3f54b025156404e34c23c03f47c3"
 dependencies = [
- "lazy_static",
  "log",
+ "once_cell",
  "tracing-core",
 ]
 
 [[package]]
 name = "tracing-subscriber"
-version = "0.3.17"
+version = "0.3.18"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "30a651bc37f915e81f087d86e62a18eec5f79550c7faff886f7090b4ea757c77"
+checksum = "ad0f048c97dbd9faa9b7df56362b8ebcaa52adb06b498c050d2f4e32f90a7a8b"
 dependencies = [
  "matchers",
  "nu-ansi-term",
@@ -1667,7 +1662,7 @@ version = "0.1.0"
 source = "git+https://github.com/trussed-dev/trussed.git?rev=cff2e663841b6a68d3a8ce12647d57b2b6fbc36c#cff2e663841b6a68d3a8ce12647d57b2b6fbc36c"
 dependencies = [
  "aes",
- "bitflags 2.4.1",
+ "bitflags 2.4.2",
  "cbc",
  "cbor-smol",
  "cfg-if",
@@ -1694,7 +1689,7 @@ dependencies = [
  "serde",
  "serde-indexed",
  "sha-1",
- "sha2 0.10.7",
+ "sha2 0.10.8",
  "zeroize",
 ]
 
@@ -1709,7 +1704,7 @@ dependencies = [
  "rand_core",
  "serde",
  "serde-byte-array",
- "sha2 0.10.7",
+ "sha2 0.10.8",
  "subtle",
  "trussed",
 ]
@@ -1725,7 +1720,7 @@ dependencies = [
  "log",
  "postcard",
  "serde",
- "sha2 0.10.7",
+ "sha2 0.10.8",
  "trussed",
 ]
 
@@ -1746,15 +1741,13 @@ dependencies = [
 [[package]]
 name = "trussed-staging"
 version = "0.1.0"
-source = "git+https://github.com/Nitrokey/trussed-staging.git?branch=hmacsha256p256-chunked#a21f11a95254dee81c6534a1260b1318bfac87b5"
+source = "git+https://github.com/Nitrokey/trussed-staging.git?rev=6e70fc4db31b92c413d56e28c6d3683a87384d46#6e70fc4db31b92c413d56e28c6d3683a87384d46"
 dependencies = [
  "delog",
- "hmac 0.12.1",
  "littlefs2",
  "rand_core",
  "serde",
  "serde-byte-array",
- "sha2 0.10.7",
  "trussed",
 ]
 
@@ -1774,15 +1767,15 @@ dependencies = [
 
 [[package]]
 name = "typenum"
-version = "1.16.0"
+version = "1.17.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "497961ef93d974e23eb6f433eb5fe1b7930b659f06d12dec6fc44a8f554c0bba"
+checksum = "42ff0bf0c66b8238c6f3b578df37d0b7848e55df8577b3f74f92a69acceeb825"
 
 [[package]]
 name = "unicode-ident"
-version = "1.0.11"
+version = "1.0.12"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "301abaae475aa91687eb82514b328ab47a211a533026cb25fc3e519b86adfc3c"
+checksum = "3354b9ac3fae1ff6755cb6db53683adb661634f67557942dea4facebec0fee4b"
 
 [[package]]
 name = "unicode-xid"
@@ -1869,10 +1862,12 @@ dependencies = [
  "generic-array",
  "heapless",
  "heapless-bytes",
+ "hmac 0.12.1",
  "pretty_env_logger",
  "serde",
  "serde-indexed",
  "serde_bytes",
+ "sha2 0.10.8",
  "trussed",
  "trussed-auth",
  "trussed-hkdf",
@@ -1900,9 +1895,9 @@ checksum = "ac3b87c63620426dd9b991e5ce0329eff545bccbbb34f3be09ff6fb6ab51b7b6"
 
 [[package]]
 name = "winapi-util"
-version = "0.1.5"
+version = "0.1.6"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "70ec6ce85bb158151cae5e5c87f95a8e97d2c0c4b001223f33a334e3ce5de178"
+checksum = "f29e6f9198ba0d26b4c9f07dbe6f9ed633e1f3d5b8b414090084349e46a52596"
 dependencies = [
  "winapi",
 ]
@@ -1919,71 +1914,128 @@ version = "0.48.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "e686886bc078bc1b0b600cac0147aadb815089b6e4da64016cbd754b6342700f"
 dependencies = [
- "windows-targets",
+ "windows-targets 0.48.5",
 ]
 
 [[package]]
 name = "windows-targets"
-version = "0.48.1"
+version = "0.48.5"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "05d4b17490f70499f20b9e791dcf6a299785ce8af4d709018206dc5b4953e95f"
+checksum = "9a2fa6e2155d7247be68c096456083145c183cbbbc2764150dda45a87197940c"
 dependencies = [
- "windows_aarch64_gnullvm",
- "windows_aarch64_msvc",
- "windows_i686_gnu",
- "windows_i686_msvc",
- "windows_x86_64_gnu",
- "windows_x86_64_gnullvm",
- "windows_x86_64_msvc",
+ "windows_aarch64_gnullvm 0.48.5",
+ "windows_aarch64_msvc 0.48.5",
+ "windows_i686_gnu 0.48.5",
+ "windows_i686_msvc 0.48.5",
+ "windows_x86_64_gnu 0.48.5",
+ "windows_x86_64_gnullvm 0.48.5",
+ "windows_x86_64_msvc 0.48.5",
+]
+
+[[package]]
+name = "windows-targets"
+version = "0.52.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7dd37b7e5ab9018759f893a1952c9420d060016fc19a472b4bb20d1bdd694d1b"
+dependencies = [
+ "windows_aarch64_gnullvm 0.52.4",
+ "windows_aarch64_msvc 0.52.4",
+ "windows_i686_gnu 0.52.4",
+ "windows_i686_msvc 0.52.4",
+ "windows_x86_64_gnu 0.52.4",
+ "windows_x86_64_gnullvm 0.52.4",
+ "windows_x86_64_msvc 0.52.4",
 ]
 
 [[package]]
 name = "windows_aarch64_gnullvm"
-version = "0.48.0"
+version = "0.48.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "2b38e32f0abccf9987a4e3079dfb67dcd799fb61361e53e2882c3cbaf0d905d8"
+
+[[package]]
+name = "windows_aarch64_gnullvm"
+version = "0.52.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "91ae572e1b79dba883e0d315474df7305d12f569b400fcf90581b06062f7e1bc"
+checksum = "bcf46cf4c365c6f2d1cc93ce535f2c8b244591df96ceee75d8e83deb70a9cac9"
 
 [[package]]
 name = "windows_aarch64_msvc"
-version = "0.48.0"
+version = "0.48.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "dc35310971f3b2dbbf3f0690a219f40e2d9afcf64f9ab7cc1be722937c26b4bc"
+
+[[package]]
+name = "windows_aarch64_msvc"
+version = "0.52.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "b2ef27e0d7bdfcfc7b868b317c1d32c641a6fe4629c171b8928c7b08d98d7cf3"
+checksum = "da9f259dd3bcf6990b55bffd094c4f7235817ba4ceebde8e6d11cd0c5633b675"
 
 [[package]]
 name = "windows_i686_gnu"
-version = "0.48.0"
+version = "0.48.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "a75915e7def60c94dcef72200b9a8e58e5091744960da64ec734a6c6e9b3743e"
+
+[[package]]
+name = "windows_i686_gnu"
+version = "0.52.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "622a1962a7db830d6fd0a69683c80a18fda201879f0f447f065a3b7467daa241"
+checksum = "b474d8268f99e0995f25b9f095bc7434632601028cf86590aea5c8a5cb7801d3"
 
 [[package]]
 name = "windows_i686_msvc"
-version = "0.48.0"
+version = "0.48.5"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "4542c6e364ce21bf45d69fdd2a8e455fa38d316158cfd43b3ac1c5b1b19f8e00"
+checksum = "8f55c233f70c4b27f66c523580f78f1004e8b5a8b659e05a4eb49d4166cca406"
+
+[[package]]
+name = "windows_i686_msvc"
+version = "0.52.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1515e9a29e5bed743cb4415a9ecf5dfca648ce85ee42e15873c3cd8610ff8e02"
 
 [[package]]
 name = "windows_x86_64_gnu"
-version = "0.48.0"
+version = "0.48.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "53d40abd2583d23e4718fddf1ebec84dbff8381c07cae67ff7768bbf19c6718e"
+
+[[package]]
+name = "windows_x86_64_gnu"
+version = "0.52.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "ca2b8a661f7628cbd23440e50b05d705db3686f894fc9580820623656af974b1"
+checksum = "5eee091590e89cc02ad514ffe3ead9eb6b660aedca2183455434b93546371a03"
 
 [[package]]
 name = "windows_x86_64_gnullvm"
-version = "0.48.0"
+version = "0.48.5"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "7896dbc1f41e08872e9d5e8f8baa8fdd2677f29468c4e156210174edc7f7b953"
+checksum = "0b7b52767868a23d5bab768e390dc5f5c55825b6d30b86c844ff2dc7414044cc"
+
+[[package]]
+name = "windows_x86_64_gnullvm"
+version = "0.52.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "77ca79f2451b49fa9e2af39f0747fe999fcda4f5e241b2898624dca97a1f2177"
 
 [[package]]
 name = "windows_x86_64_msvc"
-version = "0.48.0"
+version = "0.48.5"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "1a515f5799fe4961cb532f983ce2b23082366b898e52ffbce459c86f67c8378a"
+checksum = "ed94fce61571a4006852b7389a063ab983c02eb1bb37b47f8272ce92d06d9538"
+
+[[package]]
+name = "windows_x86_64_msvc"
+version = "0.52.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "32b752e52a2da0ddfbdbcc6fceadfeede4c939ed16d13e648833a61dfb611ed8"
 
 [[package]]
 name = "zeroize"
-version = "1.6.0"
+version = "1.7.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "2a0956f1ba7c7909bfb66c2e9e4124ab6f6482560f6628b5aaeba39207c9aad9"
+checksum = "525b4ec142c6b68a2d10f01f7bbf6755599ca3f81ea53b8431b7dd348f5fdb2d"
 dependencies = [
  "zeroize_derive",
 ]
@@ -1996,5 +2048,10 @@ checksum = "ce36e65b0d2999d2aafac989fb249189a141aee1f53c612c1f37d72631959f69"
 dependencies = [
  "proc-macro2",
  "quote",
- "syn 2.0.28",
+ "syn 2.0.52",
 ]
+
+[[patch.unused]]
+name = "trussed-hmacsha256p256"
+version = "0.1.0"
+source = "git+https://github.com/Nitrokey/trussed-hmacsha256p256.git?rev=9a12feb358437628844b844cddd08e2de0c36b3c#9a12feb358437628844b844cddd08e2de0c36b3c"
diff --git a/Cargo.toml b/Cargo.toml
index 44448e3..940cf8b 100644
--- a/Cargo.toml
+++ b/Cargo.toml
@@ -28,6 +28,9 @@ pretty_env_logger = { version = "0.4.0", optional = true }
 trussed-rsa-alloc = { version = "0.1.0", optional = true }
 trussed-staging = { version = "0.1.0"}
 
+# For hmacsha256p256
+hmac = { version = "0.12", default-features = false, optional = true}
+sha2 = { version = "0.10", default-features = false, optional = true}
 
 [dev-dependencies]
 pretty_env_logger = "0.4.0"
@@ -62,12 +65,12 @@ no-authentication = []
 apdu-peek = []
 
 # Support P256 key derivation from HMAC
-# Uses trussed-staging
-hmacsha256p256 = ["trussed-staging/hmacsha256p256"]
+# Uses custom backend extension
+hmacsha256p256 = ["hmac", "sha2"]
 
 # Allow to inject raw key data with specified type into the Trussed key store. Needed for OpenPGP support to use Kind::P256.
-# Uses trussed-staging
-inject-any-key = ["trussed-staging/hmacsha256p256"]
+# Uses custom backend extension
+inject-any-key = ["hmacsha256p256"]
 
 # Support RSA
 rsa = ["trussed-rsa-alloc"]
@@ -109,7 +112,7 @@ trussed-auth = { git = "https://github.com/trussed-dev/trussed-auth", rev = "622
 trussed-hkdf = { git = "https://github.com/Nitrokey/trussed-hkdf-backend.git", tag = "v0.1.0" }
 trussed-rsa-alloc = { git = "https://github.com/trussed-dev/trussed-rsa-backend.git", rev = "2f51478f0861ff8db19fdd5290f023ab6f4c2fb9" }
 trussed-usbip = { git = "https://github.com/Nitrokey/pc-usbip-runner", tag = "v0.0.1-nitrokey.1" }
-trussed-staging = { git = "https://github.com/Nitrokey/trussed-staging.git", branch = "hmacsha256p256-chunked" }
+trussed-staging = { git = "https://github.com/Nitrokey/trussed-staging.git", rev = "6e70fc4db31b92c413d56e28c6d3683a87384d46" }
 
 # Local development
 #trussed = { path = "../trussed" }
diff --git a/examples/usbip/main.rs b/examples/usbip/main.rs
index d1c2e70..d6d8267 100644
--- a/examples/usbip/main.rs
+++ b/examples/usbip/main.rs
@@ -8,10 +8,10 @@ const LOCATION_FOR_SIMULATION: Location = Location::Internal;
 
 mod dispatch {
     use trussed_hkdf::HkdfExtension;
-    use trussed_staging::hmacsha256p256::HmacSha256P256Extension;
     use trussed_staging::manage::ManageExtension;
     use trussed_staging::StagingBackend;
     use trussed_staging::StagingContext;
+    use webcrypt::hmacsha256p256::HmacSha256P256Extension;
 
     use trussed::{
         api::{reply, request, Reply, Request},
@@ -41,6 +41,7 @@ mod dispatch {
         Staging,
         #[cfg(feature = "rsa")]
         Rsa,
+        HmacShaP256,
     }
 
     pub enum Extension {
@@ -78,12 +79,14 @@ mod dispatch {
     pub struct Dispatch {
         auth: AuthBackend,
         staging: StagingBackend,
+        hmacsha256p256: webcrypt::hmacsha256p256::Backend,
     }
 
     #[derive(Default)]
     pub struct DispatchContext {
         auth: AuthContext,
         staging: StagingContext,
+        hmacsha256p256: webcrypt::hmacsha256p256::BackendContext,
     }
 
     impl Dispatch {
@@ -91,6 +94,7 @@ mod dispatch {
             Self {
                 auth: AuthBackend::new(LOCATION_FOR_SIMULATION),
                 staging: StagingBackend::new(),
+                hmacsha256p256: webcrypt::hmacsha256p256::Backend::new(),
             }
         }
 
@@ -98,6 +102,7 @@ mod dispatch {
             Self {
                 auth: AuthBackend::with_hw_key(LOCATION_FOR_SIMULATION, hw_key),
                 staging: StagingBackend::new(),
+                hmacsha256p256: webcrypt::hmacsha256p256::Backend::new(),
             }
         }
     }
@@ -133,6 +138,12 @@ mod dispatch {
                     request,
                     resources,
                 ),
+                Backend::HmacShaP256 => self.hmacsha256p256.request(
+                    &mut ctx.core,
+                    &mut ctx.backends.hmacsha256p256,
+                    request,
+                    resources,
+                ),
             }
         }
 
@@ -158,15 +169,6 @@ mod dispatch {
                 Backend::Rsa => Err(Error::RequestNotAvailable),
                 // #[cfg(feature = "hmacsha256p256")]
                 Backend::Staging => match extension {
-                    Extension::HmacShaP256 => <StagingBackend as ExtensionImpl<
-                        HmacSha256P256Extension,
-                    >>::extension_request_serialized(
-                        &mut self.staging,
-                        &mut ctx.core,
-                        &mut ctx.backends.staging,
-                        request,
-                        resources,
-                    ),
                     Extension::Manage => {
                         ExtensionImpl::<ManageExtension>::extension_request_serialized(
                             &mut self.staging,
@@ -178,6 +180,20 @@ mod dispatch {
                     }
                     _ => Err(Error::RequestNotAvailable),
                 },
+                Backend::HmacShaP256 => match extension {
+                    Extension::HmacShaP256 => {
+                        <webcrypt::hmacsha256p256::Backend as ExtensionImpl<
+                            HmacSha256P256Extension,
+                        >>::extension_request_serialized(
+                            &mut self.hmacsha256p256,
+                            &mut ctx.core,
+                            &mut ctx.backends.hmacsha256p256,
+                            request,
+                            resources,
+                        )
+                    }
+                    _ => Err(Error::RequestNotAvailable),
+                },
             }
         }
     }
@@ -188,7 +204,7 @@ mod dispatch {
         const ID: Self::Id = Self::Id::Auth;
     }
 
-    impl ExtensionId<trussed_staging::hmacsha256p256::HmacSha256P256Extension> for Dispatch {
+    impl ExtensionId<webcrypt::hmacsha256p256::HmacSha256P256Extension> for Dispatch {
         type Id = Extension;
 
         const ID: Self::Id = Self::Id::HmacShaP256;
diff --git a/src/lib/commands.rs b/src/lib/commands.rs
index 23e9a20..1823d9e 100644
--- a/src/lib/commands.rs
+++ b/src/lib/commands.rs
@@ -53,7 +53,7 @@ impl<
 {
 }
 
-use trussed_staging::hmacsha256p256::HmacSha256P256Client;
+use crate::hmacsha256p256::HmacSha256P256Client;
 
 #[cfg(feature = "hmacsha256p256")]
 pub trait WebcryptTrussedClient:
diff --git a/src/lib/hmacsha256p256.rs b/src/lib/hmacsha256p256.rs
new file mode 100644
index 0000000..ddb4b26
--- /dev/null
+++ b/src/lib/hmacsha256p256.rs
@@ -0,0 +1,253 @@
+// Copyright (C) Nitrokey GmbH
+// SPDX-License-Identifier: Apache-2.0 or MIT
+
+use serde::{Deserialize, Serialize};
+use trussed::types::Message;
+use trussed::{
+    client::ClientError,
+    key::{self, Kind},
+    serde_extensions::{Extension, ExtensionClient, ExtensionImpl, ExtensionResult},
+    service::{Keystore, ServiceResources},
+    types::{Bytes, CoreContext, KeyId, Location, Mechanism},
+    Error,
+};
+
+#[derive(Debug, Default)]
+pub struct Backend {}
+
+#[derive(Debug, Default)]
+pub struct BackendContext {}
+
+impl Backend {
+    pub fn new() -> Self {
+        Self::default()
+    }
+}
+
+#[derive(Debug, Default)]
+pub struct HmacSha256P256Extension;
+
+#[derive(Debug, Deserialize, Serialize)]
+#[allow(missing_docs)]
+pub enum HmacSha256P256Request {
+    DeriveFromHash(request::DeriveFromHash),
+    InjectAnyKey(request::InjectAnyKey),
+}
+
+mod request {
+    use super::*;
+    use serde::{Deserialize, Serialize};
+    use trussed::types::{KeyId, Location, Mechanism, Message};
+    use trussed::Error;
+
+    #[derive(Debug, Deserialize, Serialize)]
+    pub struct DeriveFromHash {
+        pub mechanism: Mechanism,
+        pub key: KeyId,
+        pub location: Location,
+        pub data: Option<Message>,
+    }
+
+    impl TryFrom<HmacSha256P256Request> for DeriveFromHash {
+        type Error = Error;
+        fn try_from(request: HmacSha256P256Request) -> Result<Self, Self::Error> {
+            match request {
+                HmacSha256P256Request::DeriveFromHash(request) => Ok(request),
+                _ => Err(Error::InternalError),
+            }
+        }
+    }
+
+    impl From<DeriveFromHash> for HmacSha256P256Request {
+        fn from(request: DeriveFromHash) -> Self {
+            Self::DeriveFromHash(request)
+        }
+    }
+
+    #[derive(Debug, Deserialize, Serialize)]
+    pub struct InjectAnyKey {
+        pub location: Location,
+        pub kind: Kind,
+        // pub raw_key: SerializedKey,
+        pub raw_key: Message,
+    }
+
+    impl TryFrom<HmacSha256P256Request> for InjectAnyKey {
+        type Error = Error;
+        fn try_from(request: HmacSha256P256Request) -> Result<Self, Self::Error> {
+            match request {
+                HmacSha256P256Request::InjectAnyKey(request) => Ok(request),
+                _ => Err(Error::InternalError),
+            }
+        }
+    }
+
+    impl From<InjectAnyKey> for HmacSha256P256Request {
+        fn from(request: InjectAnyKey) -> Self {
+            Self::InjectAnyKey(request)
+        }
+    }
+}
+
+#[derive(Debug, Deserialize, Serialize)]
+#[allow(missing_docs)]
+pub enum HmacSha256P256Reply {
+    DeriveFromHash(reply::DeriveFromHash),
+    InjectAnyKey(reply::InjectAnyKey),
+}
+
+mod reply {
+    use serde::{Deserialize, Serialize};
+    use trussed::{types::KeyId, Error};
+
+    use super::*;
+
+    #[derive(Debug, Deserialize, Serialize)]
+    #[non_exhaustive]
+    pub struct DeriveFromHash {
+        pub key: Option<KeyId>,
+    }
+
+    impl TryFrom<HmacSha256P256Reply> for DeriveFromHash {
+        type Error = Error;
+        fn try_from(reply: HmacSha256P256Reply) -> Result<Self, Self::Error> {
+            match reply {
+                HmacSha256P256Reply::DeriveFromHash(reply) => Ok(reply),
+                _ => Err(Error::InternalError),
+            }
+        }
+    }
+
+    impl From<DeriveFromHash> for HmacSha256P256Reply {
+        fn from(reply: DeriveFromHash) -> Self {
+            Self::DeriveFromHash(reply)
+        }
+    }
+
+    #[derive(Debug, Deserialize, Serialize)]
+    pub struct InjectAnyKey {
+        pub key: Option<KeyId>,
+    }
+
+    impl TryFrom<HmacSha256P256Reply> for InjectAnyKey {
+        type Error = Error;
+        fn try_from(reply: HmacSha256P256Reply) -> Result<Self, Self::Error> {
+            match reply {
+                HmacSha256P256Reply::InjectAnyKey(reply) => Ok(reply),
+                _ => Err(Error::InternalError),
+            }
+        }
+    }
+
+    impl From<InjectAnyKey> for HmacSha256P256Reply {
+        fn from(reply: InjectAnyKey) -> Self {
+            Self::InjectAnyKey(reply)
+        }
+    }
+}
+
+impl Extension for HmacSha256P256Extension {
+    type Request = HmacSha256P256Request;
+    type Reply = HmacSha256P256Reply;
+}
+
+pub fn derive_key_from_hash(
+    keystore: &mut impl Keystore,
+    request: &request::DeriveFromHash,
+) -> Result<reply::DeriveFromHash, Error> {
+    use hmac::{Hmac, Mac};
+    type HmacSha256P256 = Hmac<sha2::Sha256>;
+
+    let key_id = request.key;
+    let key = keystore.load_key(key::Secrecy::Secret, None, &key_id)?;
+    let shared_secret = key.material;
+
+    let mut mac =
+        HmacSha256P256::new_from_slice(shared_secret.as_ref()).map_err(|_| Error::InternalError)?;
+
+    if let Some(data) = &request.data {
+        mac.update(data);
+    }
+    let derived_key: [u8; 32] = mac.finalize().into_bytes().into();
+    let key_id = keystore.store_key(
+        request.location,
+        key::Secrecy::Secret,
+        key::Kind::P256, // TODO use mechanism/kind from the request
+        &derived_key,
+    )?;
+    Ok(reply::DeriveFromHash { key: Some(key_id) })
+}
+
+pub fn inject_any_key(
+    keystore: &mut impl Keystore,
+    request: &request::InjectAnyKey,
+) -> Result<reply::InjectAnyKey, Error> {
+    let key_id = keystore.store_key(
+        request.location,
+        key::Secrecy::Secret,
+        request.kind,
+        &request.raw_key,
+    )?;
+
+    Ok(reply::InjectAnyKey { key: Some(key_id) })
+}
+
+impl ExtensionImpl<HmacSha256P256Extension> for Backend {
+    fn extension_request<P: trussed::Platform>(
+        &mut self,
+        core_ctx: &mut CoreContext,
+        _backend_ctx: &mut Self::Context,
+        request: &HmacSha256P256Request,
+        resources: &mut ServiceResources<P>,
+    ) -> Result<HmacSha256P256Reply, Error> {
+        let keystore = &mut resources.keystore(core_ctx.path.clone())?;
+        match request {
+            HmacSha256P256Request::DeriveFromHash(request) => {
+                derive_key_from_hash(keystore, request).map(Into::into)
+            }
+            HmacSha256P256Request::InjectAnyKey(request) => {
+                inject_any_key(keystore, request).map(Into::into)
+            }
+        }
+    }
+}
+
+type HmacSha256P256Result<'a, R, C> = ExtensionResult<'a, HmacSha256P256Extension, R, C>;
+
+pub trait HmacSha256P256Client: ExtensionClient<HmacSha256P256Extension> {
+    fn derive_from_hash(
+        &mut self,
+        mechanism: Mechanism,
+        key: KeyId,
+        location: Location,
+        data: &[u8],
+    ) -> HmacSha256P256Result<'_, reply::DeriveFromHash, Self> {
+        let data = Bytes::from_slice(data).map_err(|_| ClientError::DataTooLarge)?;
+        self.extension(request::DeriveFromHash {
+            mechanism,
+            key,
+            location,
+            data: Some(data),
+        })
+    }
+
+    fn inject_any_key(
+        &mut self,
+        // raw_key: SerializedKey,
+        raw_key: Message,
+        location: Location,
+        kind: Kind,
+    ) -> HmacSha256P256Result<'_, reply::InjectAnyKey, Self> {
+        self.extension(request::InjectAnyKey {
+            location,
+            kind,
+            raw_key,
+        })
+    }
+}
+
+impl<C: ExtensionClient<HmacSha256P256Extension>> HmacSha256P256Client for C {}
+
+impl trussed::backend::Backend for Backend {
+    type Context = BackendContext;
+}
diff --git a/src/lib/lib.rs b/src/lib/lib.rs
index 3f2d3f9..9aef578 100644
--- a/src/lib/lib.rs
+++ b/src/lib/lib.rs
@@ -37,3 +37,6 @@ pub use constants::GIT_VERSION;
 pub use transport::Webcrypt;
 pub use types::RequestDetails;
 pub use types::RequestSource;
+
+#[cfg(feature = "hmacsha256p256")]
+pub mod hmacsha256p256;