String comparison is actually variable-time.
More unit tests for crypto.py code.

That brings us to 100% test coverage.