Use constant-time signature verification.

This won't make your library secure, but it will at least fix [one glaring security hole](http://codahale.com/a-lesson-in-timing-attacks/). :-)

This adds a (small) library dependency on [streql](https://github.com/PeterScott/streql), which works with all the Python versions listed in tox.ini.