Comment by victor-craton

Thank you for the interest. PIN comparison uses subtle::ConstantTimeEq, RSA signing has randomized blinding, ECDSA goes through constant-time point multiplication in p256/p384, all key material is ZeroizeOnDrop + mlock'd for its lifetime, and AES uses hardware AES-NI when available (bitsliced fallback to avoid cache-timing on lookup tables).