@erincandescent highjacking your thread to ask: what do you think about using mutual TLS instead of HTTP Signature? It authenticates the server only, but it saves time and effort.