e5ea882ed7
the implementation is copied from the other places we already check HTTP signatures, and cross-checked with Firefish's implementation