use constant_time_compare for signature comparison