The authors of the code also wrote:
WARNING: Vulnerable to timing attacks.
They know their code can leak information thru timing of its operation. Therefore, they rightly wrote:
Signature operations may leak the private key.
Signature verification should be safe.
The first sentence is because, due to the aforementioned information leak, the confidentiality of the private key (which must be used to perform a signature, and should be kept secret) could be compromised during a signature generation operation.
The second sentence is because, in a signature verification, the public key is used, and that is not secret. Thus, information leak is much less of an issue, and can't compromise the confidentiality of a key. However, there are rare situations where the signature itself is deemed secret (say, because it can be reused); that might explain the use of "should".