The HTTP hardening section ends with "when in doubt, harden", which as
written authorises adding HMAC signing or a shared secret on top of an
endpoint already gated by an unguessable per-entrypoint UUID URL. That
has been ruled against twice, and inbound signature verification was
removed from webhooker on exactly that reasoning; until now the only
text contradicting the policy was webhooker's own README.
Adds one scoped carve-out immediately after that sentence: such a URL is
a complete credential and gets no second factor, not even as defence in
depth. The consequences that do follow — keep it out of logs and
tickets, rotate by minting a new entrypoint — are stated, as is what to
do with a sender that only supports signed payloads. Nothing in the
surrounding hardening guidance is removed or weakened.
