constant-time string compare in `verifySignature`