Use a constant-time compare for the signature.

Both inputs are public so there's no obvious point, but it's what NaCl
does.