Sign a UTF-8 message with a UTF-8 secret (Web Crypto). Compare with Stripe-style v1 signatures or custom webhooks.