Function derive_key 

pub async fn derive_key(
    variant: Sha2Variant,
    input: &DeriveInput,
    length: Option<u32>,
    options: MacKeyOptions,
) -> Result<Mac, Error>

Mint an HMAC key over variant from a parameterized derivation: the derivation runs at length bits (None means the hash’s block size, the generate_key default) and the result is subject to import_key_raw’s contract.

Requires the input’s derive_key grant — and, for an extractable key, derive_bits too (an exportable key is bits disclosure by other means); refusals fail Error::NotPermitted.