RT3066: rewrite RSA padding checks to be slightly more constant time.