private function validateChallenge(
        ChallengeProvider $from,
        ChallengeProvider $to
    ): bool {
        // Note: strictly speaking, this shouldn't even be targetable as
        // a timing attack. However, this opts to be proactive, and also
        // ensures that no weird PHP-isms in string handling cause mismatched
        // values to validate.
        if (!hash_equals($from->getChallenge(), $to->getChallenge())) {
            throw new SE(SE::CHALLENGE_MISMATCH);
        }
        // TOOD: generate and compare timestamps
        return true;
    }