regarding verification; checking the presence of specific headers, and checking that the date falls within a certain window, and checking a Digest... are all g

regarding verification; checking the presence of specific headers, and checking that the date falls within a certain window, and checking a Digest... are all good things to do. It's not so difficult to do them yourself, even if the spec doesn't require it. You could say the spec doesn't go far enough. Apigee (API Gateway) has an HTTPSignature verification callout that does all of those things. You just need to configure it.