Right now verifyHMAC asserts that secret is a string. This secret is used for createHmac.
Hmac secrets work with binary data, so when a string is used that means it converts that to the utf8 binary representation of that text to use as the secret.
In comparison the Python library I used required that the secret be a binary type (bytes).
I think it would be fair for verifyHMAC to allow the secret to be a Buffer.