I think we're going to need to see your code to know what your problem is.

You might want to write a simplified script with just enough code to reproduce the error. That will make it easier for us and making that script often leads to a solution in itself.

Are you saying you get absolutely nothing on STDIN when processing the POST request? Or are you saying you can't verify the sig? Is this header-based signature validation a standard thing or is it something you're making from scratch? If it's standard, I'd be surprised if there isn't a CPAN module...