Update notes for submitted changes

* Use hmac.compare_digest to compare signature