This is presumably where the constant time PKCS7 verification would end up living too? That's not a comparison function.

`constanttime` seems like a logical choice.