Use constant time compare for signature validation