private byte[] expandImpl(int wantedBytes, byte[] context) {
        /*
           RFC-5869, Step 2.3, Expand:

           HKDF-Expand(PRK, info, L) -> OKM

           Inputs:
              PRK      a pseudorandom key of at least HashLen octets
                       (usually, the output from the extract step)
              info     optional context and application specific information
                       (can be a zero-length string)
              L        length of output keying material in octets
                       (<= 255*HashLen)

           Output:
              OKM      output keying material (of L octets)

           The output OKM is calculated as follows:

           N = ceil(L/HashLen)
           T = T(1) | T(2) | T(3) | ... | T(N)
           OKM = first L octets of T

           where:
           T(0) = empty string (zero length)
           T(1) = HMAC-Hash(PRK, T(0) | info | 0x01)
           T(2) = HMAC-Hash(PRK, T(1) | info | 0x02)
           T(3) = HMAC-Hash(PRK, T(2) | info | 0x03)
           ...
        */
        var prkHmac = createKeyedHmacSha256(pseudoRandomKey);
        int blocks  = (wantedBytes / HASH_LEN) + ((wantedBytes % HASH_LEN) != 0 ? 1 : 0); // N
        var buffer  = ByteBuffer.allocate(blocks * HASH_LEN); // T
        byte[] lastBlock = EMPTY_BYTES; // initially T(0)
        for (int i = 0; i < blocks; ++i) {
            prkHmac.update(lastBlock);
            prkHmac.update(context);
            prkHmac.update((byte)(i + 1)); // Number of blocks shall never exceed 255
            // HMAC instance can be reused across doFinal() calls; resets back to initially keyed state.
            lastBlock = prkHmac.doFinal();
            buffer.put(lastBlock);
        }
        buffer.flip();
        byte[] outputKeyingMaterial = new byte[wantedBytes]; // OKM
        buffer.get(outputKeyingMaterial);
        return outputKeyingMaterial;
    }
Derives a key with a given number of bytes. The returned key is always deterministic
for a HKDF initialized with a specific salt+IKM pair.

<p>If more than one key is to be derived, use {@link #expand(int, byte[])}</p>

<p>Thread safety: multiple threads can safely call <code>expand()</code> simultaneously
on the same HKDF object.</p>

@param wantedBytes Positive number of output bytes. Must be less than or equal to {@link #MAX_OUTPUT_SIZE}
@return A byte buffer of size wantedBytes filled with derived key material
security-utils/src/main/java/com/yahoo/security/HKDF.java