Even that collisions are unlikely we need to make sure the two strings
are equal.

Timing is not important in this case because this only runs after the
comparison between the SHA256 digested strings returns true.