Webhook Verification
Validate raw signed deliveries before updating local state
Webhook handling should be intentionally strict: verify first, then trust the payload.
eventTypeDo not parse and re-stringify the JSON before verification. The signature is computed over the original raw request body bytes.