* I may be old-fashioned, but don't require inside classes (0)
* think about private vs. protected in respect to extending later on
General question, don't you want to probe for extensions (1) in the constructor and set a couple internal flags based on that? You could probably save yourself the hassle function_exists() later on. But that's just a thought.
Unfortunately it's subject to a BSD license so I can't rob you blind today ;).
I'll check the extension route - if it reduces the code a bit more I'll use it. I'm not entirely sure how someone could extend HMAC though that may be a sign to make it possible at least...
The only class included within the code block is the Exception class. Reason for doing so was to reduce the overall Exception classes any application loads up front (I had a few loading scores at a time until I started lazy loading them all). I don't think it's a performance issue - opcode caches will cache the file itself when its included this way, but cannot cache the class/method creation (so the majority benefit still takes place - no file read). My terminology for PHP internals sucks but I believe that's accurate (sort of).