GitHub webhooks can have a [shared secret](https://developer.github.com/v3/repos/hooks/#create-a-hook), that the webhook can use to verify that the payload came from GitHub. It doesn't look like this is supported here, but I think it should be!