LMSSigner and HSSSigner clear any buffered message on init() and refuse a one-shot generateSignature(byte[]) / verifySignature(byte[], byte[]) call made with a message already absorbed through update(), the refusal preceding the key read so a rejected call spends no one-time key.