Webhook signing is missing test coverage.
Need to verify the resulting signature works as expected. The exact same algorithm is used across multiple webhook integrations.