Webhook Signatures

Verify signed webhook requests.

Compute HMAC-SHA256 over TIMESTAMP.PAYLOAD using the subscription signing secret. Compare the result with X-Cbizzle-Signature using a timing-safe comparison.