Use hash_equals() for signature verification

Also, why not just `return $a === $b` if the function does not exist?