docs: protected boolean verifySignedRequest(String appSecret, String algorithm, String encodedPayload, byte[] signature) {
      verifyParameterPresence("appSecret", appSecret);
      verifyParameterPresence("algorithm", algorithm);
      verifyParameterPresence("encodedPayload", encodedPayload);
      verifyParameterPresence("signature", signature);
  
      // Normalize algorithm name...FB calls it differently than Java does
      if ("HMAC-SHA256".equalsIgnoreCase(algorithm)) {
        algorithm = "HMACSHA256";
      }
  
      try {
        Mac mac = Mac.getInstance(algorithm);
        mac.init(new SecretKeySpec(toBytes(appSecret), algorithm));
        byte[] payloadSignature = mac.doFinal(toBytes(encodedPayload));
        return Arrays.equals(signature, payloadSignature);
      } catch (Exception e) {
        throw new FacebookSignedRequestVerificationException("Unable to perform signed request verification", e);
      }
    }