Use a constant-time compare

model/message.go

@@ -37,12 +37,11 @@ func compareSignatures(a []byte, b []byte) bool {
 	if len(a) != len(b) {
 		return false
 	}
+	int d = 0
 	for i := range a {
-		if a[i] != b[i] {
+		d := d | (a[i] ^ b[i])
-			return false
-		}
 	}
-	return true
+	return d == 0
 }
 
 // GetMessages returns a copy of the entire timeline