Money is only ever believed once
Every notification is checked against Stripe's signature over the exact bytes received, inside a five-minute replay window. An unsigned or altered notification is refused outright — never logged as a warning that still moves a payment.