Function derive_key 

pub fn derive_key(context: &str, key_material: &[u8], out: &mut [u8])

One-shot derive_key KDF: bind key_material to context, arbitrary output. The context string should be a hardcoded, application-unique, globally-unique constant. BLAKE3 spec §2.1 / §5.