Outbound requests, treated as the risk they are

The address is checked, not the hostname

A hostname is whatever DNS says it is at the moment of the request, and plenty of public names resolve to 127.0.0.1 on purpose. So the check that matters runs on the resolved address, and it runs again on every redirect.

• Loopback, private ranges, and carrier-grade NAT are refused
• Link-local is refused, which covers the cloud metadata service that hands out instance credentials
• IPv6 is covered, including the IPv4-mapped forms used to slip past naive checks
• A redirect to a blocked address fails, even when the first hop was innocent

Signatures over the exact bytes

The signature is computed over the body as sent. A receiver that re-serialises the JSON before checking would compute a different digest for the same object and conclude, correctly from its side, that the delivery is forged.

Retries that do not make an outage worse

Backoff is exponential with jitter, so a receiver that goes down does not get every pending delivery back at the same instant. A 4xx is not repeated, because the receiver understood and refused; the two that mean "later" are the exceptions.

Endpoints that stop answering are switched off

A webhook that has not succeeded in a week is an endpoint nobody owns any more, and continuing to call it is a slow outbound attack on somebody else's server.