@pfefferle I recommend *not* writing your own. I tried and fucked up!
https://shkspr.mobi/blog/2024/03/i-made-a-mistake-in-verifying-http-message-signatures/