Use a constant time equality check for HMAC signature verification