Signatures
Check that an event really comes from Keryk.
Every event is signed with your webhook secret. Verify the signature before you trust the body, and reject events older than a few minutes.
Draft
The header name and signing scheme are still being designed. [SIGNATURE SCHEME]