Justin Stern commented on HMAC calculation correct on orders/create but wrong on refunds/create

Yup, that seems to be the case.  I forgot that you can configure webhooks through the admin.  From the documentation:

Webhooks created manually through the Shopify admin cannot be verified using the following technique.

http://docs.shopify.com/api/tutorials/using-webhooks#verify-webhook