Requests are signed with HMAC-SHA256 v1 headers X-CC-Timestamp, X-CC-Nonce
and X-CC-Signature. The Signature header is gone. Webhooks are verified with
HMAC-SHA256 v1 over the raw body: X-Webhook-Delivery, X-CC-Timestamp,
X-CC-Signature.