[z77dj3kl]

That's not how timing attack mitigation works: just because you're doing some other stuff too doesn't mean the timings can't be exploited.

[arcurn]

Yep, but there will be no variance in timing from the end user's perspective (regardless of what payload they send to E3) because neither encryption results nor timing data get returned to the end user.