Use constant-time compare function when comparing HMAC signatures

I noticed `compare()` provides a contant-time comparison function for comparing HMAC signatures, however was never called anywhere. This patch updates the `secure_loads()` function to use `compare()` when comparing HMAC signatures.