Verify webhook signature

[RobRoseKnows]

I was thinking of submitting a PR to verify webhook signatures since this Engine doesn't do that already.

I was wondering what the best behavior would be for invalid signatures though:

1. Return a bad status code
2. Log an error
3. Raise an exception

Do you have any thoughts?

[asgerb]

@RobRoseKnows sorry for not getting to this until now. My initial hunch is to go for raising an exception, that feels like the most visible way of dealing with it. Do you have any thoughts and arguments for the different approaches?

[asgerb]

@RobRoseKnows I was looking for some prior art and it seems in the mux node sdk they raise an error too:
https://github.com/muxinc/mux-node-sdk/blob/5b63e5bebb948c095b8593c8d4acc976ed8158a4/src/resources/webhooks.ts#L115