Signed, Sealed, Mangled: Why Webhook Signatures Fail Behind a Tunnel

You point a tunnel at localhost:3000, send a test event, and your handler answers 400 Invalid...