<SYSTEM_TASK:>
Solve the following problem using Python, implementing the functions described below, one line at a time
<END_TASK>
<USER_TASK:>
Description:
 def verify_telesign_callback_signature(api_key, signature, json_str):
 """ Verify that a callback was made by TeleSign and was not sent by a malicious client by verifying the signature. :param api_key: the TeleSign API api_key associated with your account. :param signature: the TeleSign Authorization header value supplied in the callback, as a string. :param json_str: the POST body text, that is, the JSON string sent by TeleSign describing the transaction status. """

    your_signature = b64encode(HMAC(b64decode(api_key), json_str.encode("utf-8"), sha256).digest()).decode("utf-8")

    if len(signature) != len(your_signature):
        return False

    # avoid timing attack with constant time equality check
    signatures_equal = True
    for x, y in zip(signature, your_signature):
        if not x == y:
            signatures_equal = False

    return signatures_equal