(fix) Use HMAC for signatures

Using a plain SHA-256 hash for message authentication is vulnerable to length extension attacks. Use the secure HMAC construct from rust-crypto.

In addition to this, the signature comparison should be done in constant time. See https://github.com/DaGenix/rust-crypto/issues/90.

(I temporarily applied the patch from #20 to my branch for building. I'll rebase it out once it's merged.)