Signed webhooks for an invoicing API

Design how an invoicing platform signs the webhooks it sends to its customers' servers, so a customer can be sure that an "invoice.paid" event really came from the platform and was not altered or replayed. The platform sends about 1 million webhooks a day to 12,000 customer endpoints. Each customer has a signing secret they can view and rotate from a dashboard, and a rotation must not break their integration. Describe how events are signed, what the receiver checks, how secrets are stored and rotated, and how you help customers verify correctly.