Clients have a problem along the lines of “we need to hash a bunch of different values together” or “we need a MAC” or “we need a key derivation function for passwords,” and the closest tool at hand is a hash function. While Keccak doesn’t suffer from the length-extension attacks that HMAC is meant to address, the phrase “simply prepending the message with the key” carries a lot of assumptions about key length and key formatting with it. If you want to make sure you can point to a NIST-approved function, you can use a memory-hard password KDF like Balloon or Argon2 to generate a key K 1 from the password and salt, use PBKDF2 to generate a key K 2 from the password and salt, and finally use a FIPS-approved function like HKDF to combine them into a final key K = HKDF(K 1 ‖K 2 ).