This works fine, but IIRC the general pattern in SDKs is to simply set the signature verification in RoxOptions, which avoids needing the SDK key as much. Looks like that was how it was working originally, but only if a RoxOptions was actually provided; don't we need to just always have a RoxOptions and set the signature verification in it (for a Unify SDK key)?

other SDKs works because their options objects are mutable (can set properties directly). PHP's RoxOptions is immutable. so if we want to do then we need to use reflection like -

if (ApiKeyHelpers::isCBPApiKey($apiKey) &&
  !$roxOptions->isSignatureDisabled()) {
      $reflection = new \ReflectionClass($roxOptions);
      $property = $reflection->getProperty('_disableSignatureVerification');
      $property->setAccessible(true);
      $property->setValue($roxOptions, true);  // Force mutate
  }

Instead of using reflection (which feels hacky in PHP), I thought it's cleaner to check the API key directly when we actually need to verify the signature. wdyt?