Webhook retries: signature issue or idempotency issue first?

A webhook debugging question about separating verification failures from duplicate processing failures.

Webhook retry bugs get messy because the same symptom can come from raw body parsing, wrong secret, endpoint timeout, or duplicate processing on retry. I like to split the first check into signature verification, delivery status, and idempotency key behavior. If the provider retries and the second delivery fails differently, that can be a separate bug. How do you decide whether to inspect signatures or idempotency first?