Pass PRF as raw bytes instead of string

Pass PRF as raw bytes instead of string

Avoiding string serialization is more performant and simpler, and more importantly reduces the places where this sensitive value is written to memory. By keeping the value in buffer we can immediately zero it out manually instead of waiting for garbage collection.

The value is still "leaked" via DevTools inspection and other points in the network stack, but that is out of the control of JS.