I have a server that sends webhook notifications to client servers. Before the client server begins processing anything, it should be certain that the webhook originated from my server, and that it was not altered or spoofed.
I can use a JSON Web Token (JWT) to sign the request and payload with a pre-shared secret key to ensure all of the above.
Is this completely redundant if the webhook is sent over HTTPS anyway?