code: function verifyMessage(callbackBody, contentSignature, signingKey) {
    const hash = crypto.createHash('sha256').update(signingKey).digest();
    const hmac = crypto.createHmac('sha256', hash);
  
    return contentSignature === hmac.update(JSON.stringify(callbackBody)).digest('base64');
  }
docs: Validate a callback body against signed key
  @param {CallbackPayload} callbackBody
  @param {string} contentSignature
  @param {string} signingKey
  @returns {boolean}