From a short look at the module it is using a plain HMAC together with SHA-1 (or SHA-512 in newer versions). This is the same algorithm as used in TLS to detect data manipulation.
But a HMAC can be computed fast. The major costs in the HMAC are the hash computation (i.e. SHA-1 in your case) which is needed twice. This means that if you have a weak secret a brute-force attack is possible. And, while Signer seems to offer the use of a key derivation function to "harden" the key the offered functions are only a single hash or a HMAC (i.e. two hashes), which don't really slow down a brute-force attack.
This means that the security of this approach lies in choosing a good secret key, i.e. some long random string instead of a comparable short password. Unfortunately the documentation does not really show what keys are secure and only makes some recommendations similar to password recommendations:
Given a key only you know ... So if you keep the key secret and complex, you will be fine.
But from similar password recommendations we all know how secure such keys will be at the end. What you really should use is hidden in the source code in the documentation of
Keep in mind that the key derivation in itsdangerous is not intended
to be used as a security method to make a complex key out of a short
password. Instead you should use large random secret keys.
The following would create a secret with 128 random bits which is sufficiently secure against brute-force attacks:
secret_key = os.urandom(16)