Webhook signatures still use deprecated SHA-1

Outgoing webhook signatures are HMAC-SHA1. Please move to SHA-256 (with a transition period and both headers).