OK. So at least I'm not missing anything. An idea: use the shared secret from a Private App. Thus, when user is creating a webhook, optionally allow authenticating it by choosing a Private App.
How can I monitor this to know if/when an update to the webhook feature is completed? Thanks, Chris
Ryan