Verifies a timestamped Incld-Signature header and returns the parsed payload.

The signature format is t=<unix seconds>,v1=<hex digest>. The digest is an HMAC-SHA256 over <timestamp>.<raw body>. Signatures older or newer than the tolerance are rejected; the default tolerance is five minutes.