We sport our own HKDF functionality implementation (that's still based on libgcrypt), but should switch to the one in libgcrypt once it's available. Desire for this functionality still has to be signaled upstream, in libgcrypt.