Use hash_equals() for signature verification

One final request - please rebase your commits into a single commit using `git rebase -i HEAD~3`