add payload verification for fields expected to be hex strings

This will ensure these fields are valid hex strings and can safely be converted to a `Buffer`.

Incidentally, this already found a bug, `bigint.toString(16)` doesn't pad, and sometimes outputs an unparseable hex string.