Perform constant time string comparison when validating signatures

String#== is not safe for the purposes of validating cryptographic
signatures because it enables timing attacks.