Use hash_equals() for signature verification

You're comparing a cryptographic secret. (Specifically, a signature.)