That verifies the output of the timing-resistant version of the
signing function, to make it also fault-resistant.