Current Behavior:

Alerts / notifications sent via Webhook are neither authenticated nor signed in any way.
This makes it hard for receiving parties to verify whether a given notification was sent by DT.

Proposed Behavior:

For the Webhook alert type, allow for an optional shared secret to be provided.
Before sending the webhook request, calculate an HMAC for the JSON payload, and include the resulting value in a request header (e.g. X-Webhook-Signature).

For reference, this is also how GitHub is doing it: https://docs.github.com/en/developers/webhooks-and-events/webhooks/securing-your-webhooks