Passwords are a bad example, but think of a simple signed cookie for example. It's signed with a key that is only known to the server, and the cookie is sent a

Passwords are a bad example, but think of a simple signed cookie for example. It's signed with a key that is only known to the server, and the cookie is sent as signature + content. The server has to hash the content using the key, and then validate the signature matches the signature the server just created. If you don't use constant time comparison for this you leak information about the valid signature.