Timing side-channel in TLS fingerprint validation hash comparison

In the MitM-proof authentication path, the connector compares its computed validation hash against the server-supplied value using str ==, which is not constant-time (it short-circuits on length and the first differing character).

Since the server value is attacker-influenceable, the accept/reject timing leaks the matching-prefix length, potentially allowing byte-by-byte recovery of the expected hash and forgery of a valid server proof.

goal is to use hmac.compare_digest that is a constant time comparison