Use an equal time comparison for signatures

Fixes a theoretical timing attack:

Based on devise secure_compare:
https://github.com/plataformatec/devise/blob/master/lib/devise.rb#L447

More info:
http://rdist.root.org/2010/01/07/timing-independent-array-comparison/