Add support for signing webhook requests

[raymond-h]

Would be great if whatever receives the webhook could somehow verify that the request is indeed coming from the bot.

An asymmetric keypair would be useful to only need a single private key in the bot itself to sign data with, while being able to give out the public key to anyone. With a symmetric key, one needs to be careful each webhook has its own key which needs to be kept securely.