make sure DSA signing exponentiations really are constant-time