byte[] toDerivedBytes(int nHashBytes, byte[] domainSeparationContext) {
        var hkdf = HKDF.unsaltedExtractedFrom(secretTokenBytes);
        return hkdf.expand(nHashBytes, domainSeparationContext);
    }
Token derivations are created by invoking a HKDF (using HMAC-SHA256) that expands the
original token secret to the provided number of bytes and the provided domain separation
context. The same source token secret will result in different derivations when
different contexts are used, but will always generate a deterministic result for the
same token+#bytes+context combination.
security-utils/src/main/java/com/yahoo/security/token/Token.java