No timing attacks for you!

https://www.isecpartners.com/blog/2011/february/double-hmac-verification.aspx

Let's not compare hashes in a way that creates cryptographic side-channels.