code: protected function verifySign(array $retData)
      {
          $retSign = $retData['sign'];
          $values = ArrayUtil::removeKeys($retData, ['sign', 'sign_type']);
  
          $values = ArrayUtil::paraFilter($values);
  
          $values = ArrayUtil::arraySort($values);
  
          $signStr = ArrayUtil::createLinkstring($values);
  
          $signStr .= '&key=' . $this->config->md5Key;
          switch ($this->config->signType) {
              case 'MD5':
                  $sign = md5($signStr);
                  break;
              case 'HMAC-SHA256':
                  $sign = hash_hmac('sha256', $signStr, $this->config->md5Key);
                  break;
              default:
                  $sign = '';
          }
  
          return strtoupper($sign) === $retSign;
      }
docs: 检查微信返回的数据是否被篡改过
  @param array $retData
  @return boolean
  @author helei