Use hash_equals() for signature verification

We need to put the curly brace on the same line, i.e. `for (...) {`