I’ve been re-reading this part, why are 5 hashes needed? It looks to me like 2 are sufficient: one to compute the identity commitment and another one to HMAC the message.
I’ve recently finished implementing this scheme in my project Libernet and that’s how I did it. This is the reusable chip: crypto/src/hmac.rs at d653000d3f3d21c671fac8cb6857e86afd677460 · libernet-mirror/crypto · GitHub
(I used a terminology that resembles actual signatures: I called your “REV” simply “private key” and your “identity commitment” simply “public key”.)