use constant time comparison when checking signatures