config: Improve comment for HMACKeyConfig and add TODOs (#7633)

cmd/boulder-wfe2/main.go

@@ -76,6 +76,8 @@ type Config struct {
 		// an HMAC-SHA256 key (e.g. the output of `openssl rand -hex 32`). In a
 		// multi-DC deployment this value should be the same across all
 		// boulder-wfe and nonce-service instances.
+		//
+		// TODO(#7632) Update this to use the new HMACKeyConfig.
 		NoncePrefixKey cmd.PasswordConfig `validate:"-"`
 
 		// Chains is a list of lists of certificate filenames. Each inner list is

cmd/config.go

@@ -554,7 +554,9 @@ type DNSProvider struct {
 	SRVLookup ServiceDomain `validate:"required"`
 }
 
-// HMACKeyConfig contains a path to a file containing an HMAC key.
+// HMACKeyConfig specifies a path to a file containing an HMAC key. The key must
+// consist of 256 bits of random data to be suitable for use as a 256-bit
+// hashing key (e.g., the output of `openssl rand -hex 32`).
 type HMACKeyConfig struct {
 	KeyFile string `validate:"required"`
 }

cmd/nonce-service/main.go

@@ -33,6 +33,8 @@ type Config struct {
 		// suitable as an HMAC-SHA256 key (e.g. the output of `openssl rand -hex
 		// 32`). In a multi-DC deployment this value should be the same across
 		// all boulder-wfe and nonce-service instances.
+		//
+		// TODO(#7632) Update this to use the new HMACKeyConfig.
 		NoncePrefixKey cmd.PasswordConfig `validate:"required"`
 
 		Syslog        cmd.SyslogConfig