Use hash_equals() for signature verification

I'm not sure this qualifies as a timing attack vulnerability... this is a simple string comparison, not a cryptographic algorithm.  I don't understand how this could leak any valuable information...

Thank you for the article. I read through it, and I am not convinced it applies here.