fix timing vulnerability in verify_gateway_signature

see https://en.wikipedia.org/wiki/Timing_attack