Rotate the Webhook Signing Key

Create a new signing key for your organization. It is published at once, beside the key it replaces, and for the next twenty-four hours every delivery carries a signature under each; then the old key is withdrawn. Read the keys, start verifying with the new one, and keep the old until it is withdrawn. A rotation while one is running, or before your organization has a key, is refused.