I'm a bit concerned here that `assertionUrl` is relative. There's technically no reason why the webhook target is going to have any idea of who is hitting it. Might be a bit different if `webhook.call` sent a `referer` or `via` header, I suppose.

But I might be overthinking things.