(@tseaver) Working from the internal support request / user guide, steps are:

• Add class google.cloud.storage.hmac.HMACKeyMetadata (representing resource returned from create / get / list operations, and passed to update). Holds reference to a client, and maps resource entities onto properties. (Storage: add 'google.cloud.storage.hmac_keys.HMACKeyMetadata' resource class. #8041)
• Add Client.create_hmac_key method, taking service_account_email and returning a tuple, (metadata, secret), where metadata is an HMACKeyMetadata instance and secret is the bytes returned by the hmacKeys.create API. (Storage: add 'Client.list_hmac_keys' method. #8043)
• Add Client.list_hmac_keys method, taking optional service_account_email, max_results, and show_deleted_keys, and returning an iterator whose items are HMACKeyMetadata instances. (Storage: add 'Client.list_hmac_keys' method. #8043)
• Add HMACKeyMetadata.exists method. (Storage: Add 'HMACKeyMetadata.{exists,reload,update,delete}' API methods. #8045)
• Add HMACKeyMetadata.reload method. (Storage: Add 'HMACKeyMetadata.{exists,reload,update,delete}' API methods. #8045)
• Add HMACKeyMetadata.update method, pushing the current value of the HMACKeyMetadata.state property. (Storage: Add 'HMACKeyMetadata.{exists,reload,update,delete}' API methods. #8045)
• Add HMACKeyMetadata.delete method. (Storage: Add 'HMACKeyMetadata.{exists,reload,update,delete}' API methods. #8045)
• Add system tests exercising the CRUD cycle.