Use hash_equals() for signature verification

Sure. One moment :)