NIST claims that the security of HMACs is given by `MIN(key_len, 2 * out_len)` which means that HMACs with`out_len == key_len` provide a security strength equal to the length of the key. Considering NIST classifies a key-search attack on AES-256 at the highest security level (and that AES keys must be at least 256 bits long to prevent Grover's quantum search attack), does this also translate to HMACs? Does this mean every HMAC having a >= 256 bit key (which is pretty much every SHA2/3 based HMAC) is secure against brute-force attacks by a quantum computer?