Use a constant time comparison for checking the signatures

[zsims]

This is to mitigate against timing attacks, e.g. https://verboselogging.com/2012/08/20/a-timing-attack-in-action