You want to compare a user-supplied HMAC against the expected one without leaking timing information. Which use of `crypto.timingSafeEqual` is correct?
const expected = crypto.createHmac('sha256', key).update(body).digest();
const given = Buffer.from(req.headers['x-signature'], 'hex');