Signature Verification: Exactly One Should Match

[StevenXL]

Describe the bug

Recurly documentation indicates that, for a webhook notification to be valid, exactly one signature should match. The code at here would allow for any number of matches.