HMAC was introduced in , as a MAC that has its security proof based on the properties on the underlaying hash function.
The hash functions considered in that paper were ones based on the Merkle-Damgaard paradigm where in most cases, block sizes that messages're chunked into are greater than the output length of the hash function. For keys larger than then block size, the key will be hashed before use.
After the success of Keccak/SHA-3, permutation-based cryptography becomes increasingly popular, and I noticed something a bit strange. The Gimli hash function as proposed in its current form  in the Round 2 of NIST Lightweight Cryptography project, has capacity only capable of 128-bit overall security, for both collision and pre-image resistance, but with a 256-bit output.
Q: What will happen if HMAC was instantiated with Gimli? Will the security strength of HMAC-Gimli256 decrease from 256-bit to 128-bit and why and how? Can it use keys larger than 128 bits?
 Keying Hash Functions for Message Authentication Mihir Bellare, Ran Canettiy, and Hugo Krawczyk