The detail that stands out is verifying the signature against the raw bytes before any JSON parsing, since re-serialising a body that verified fine is exactly the kind of silent breakage that is hard to trace in production. The pairing of a short timestamp window with event-ID deduplication is also a neat division of labour: the window limits how long a captured request stays useful, while dedup makes a replay inside that window harmless. One question: with the five-minute window checked before the HMAC, how does the receiver handle a sender whose clock runs a little ahead — is the tolerance for future timestamps the same five minutes, or tighter?