Signed, Sealed, Mangled: Why Webhook Signatures Fail Behind a Tunnel

You point a tunnel at localhost:3000, send a test event, and your handler answers 400 Invalid signature. The payload looks right. The secret looks right. So why does webhook signature verification fai