Also, in interpreted languages, it's difficult to know whether the primitive operations actually are constant time, which is why I think the better universal so

Also, in interpreted languages, it's difficult to know whether the primitive operations actually are constant time, which is why I think the better universal solution is to hash both the MAC from the untrusted input as well as your own computed MAC once more with the same HMAC with a random key and only then do the comparison on the result of that. The HMAC should be constant time anyhow, and with this construction, it shouldn't matter much whether the final comparison is constant time.