I want to sign webhooks so that client services can verify that a request came from my service.
Looking around, it seems that most SaaS use symmetric keys shared by the client and the SaaS. Obviously, there's an overhead of generating and storing a unique secret for each client here.
It seems to me like asymmetric crypto is an easier solution here: sign the payload with a private key, publish the public key on your website, and you avoid the overhead of maintaining shared secrets for each client.
Given the above, is there a good reason many reputable SaaS (GitHub, Stripe, Slack etc.) opt for using shared secrets for signing webhooks? What are the tradeoffs of the approaches?