Not only to mitigate timing attacks, but also to limit fingerprinting by data-harvesting entities.