>>> About code. Instead (PyBytes_CheckExact(a) && PyBytes_CheckExact(b)) you
>>> should use ((PyBytes_CheckExact(a) != 0) & (PyBytes_CheckExact(b) !=
>>> 0)).
>>
>> What's the difference? They are the same.
> 
> Laziness. If "a" (a secret key) is not bytes then PyBytes_CheckExact(b)
> ("b" is a user input) is not called. It exposes secret key type. I'm not
> sure if it is real secret however.

I see; I missed that your version was using &. In any case, I don't
think this is a threat: you couldn't use it to get the secret key
faster.