- The `hkdf` and `node-hkdf` packages are unmaintained 0.0.2 re-implementations of RFC 5869.
- Node and the browser both ship HKDF already, so FxA does not need either package.
- Part of the FxA dependency reduction work in FXA-13426.
- Changes `hkdf.js` in fxa-auth-server to call the native `crypto.hkdfSync`.
- Keeps the old null-salt behaviour with `salt || Buffer.alloc(32)`, so the output bytes do not change.
- Changes `scoped-keys.ts` in crypto-relier to derive bits with Web Crypto HKDF.
- Removes `hkdf` from fxa-auth-server and `node-hkdf` from the root package, and deletes the orphaned `types/node-hkdf/index.d.ts` shim.
- Adds no new package.
Closes: FXA-13922