Use hash_equals() for signature verification