Use signing algorithm in payload

[zcox]

The [spec][1] defines the signature algorithm in the standard payload fields. Probably should parse that out and use it, instead of just assuming HMAC-SHA256.