Use hash_equals() for signature verification

formatting - we need a space between `for (` and the curly opening curly brace on the same line.