Verify the Webhook Signature

Webhooks (Stripe, GitHub, Ghost) prove they're genuine with an HMAC-SHA256 signature. The first line is T; each next line is key message signature separated by single spaces (key and message have no spaces; the signature is hex in any case). Print VALID if the signature equals HMAC-SHA256(key, message) as hex, otherwise INVALID.

In real code, compare with a constant-time function (hmac.compare_digest, crypto.timingSafeEqual, hash_equals, MessageDigest.isEqual).