The key one door's offline scan cache digests under. The HMAC runs under the site's encryption key with the door's name as the only variation. The scanner page carries the key, so the device can digest scans offline. The cache response itself never carries the key.