卡片消息回调代码有问题，设置了密码和token之后配置不了，同样的密码和token，事件回调可以通过验证，卡片订阅不能通过验证，事件回调的地址放到卡片订阅也可以通过。

如题。我们在使用事件回调和卡片消息回调时同样的key和token，一个能通过校验，一个不能。通过排查，发现两个方法SDK的签名验证逻辑的代码不一样，一个用的是key，一个用的token

` private boolean verifySign(EventReq eventReq) throws NoSuchAlgorithmException {
if (Strings.isEmpty(verificationToken)) {
return true;
}

    String cipherEventJsonStr = new String(eventReq.getBody(), StandardCharsets.UTF_8);
    String timestamp, nonce, sourceSign, targetSign;
    timestamp = eventReq.getHeaderFirstValue(Constants.X_LARK_REQUEST_TIMESTAMP);
    nonce = eventReq.getHeaderFirstValue(Constants.X_LARK_REQUEST_NONCE);
    sourceSign = eventReq.getHeaderFirstValue(Constants.X_LARK_SIGNATURE);
    targetSign = calculateSignature(timestamp, nonce, verificationToken, cipherEventJsonStr);
    return targetSign.equals(sourceSign);
}`

`private boolean verifySign(EventReq eventReq) throws NoSuchAlgorithmException {
if (Strings.isEmpty(encryptKey)) {
return true;
}

    String cipherEventJsonStr = new String(eventReq.getBody(), StandardCharsets.UTF_8);
    String timestamp, nonce, sourceSign, targetSign;
    timestamp = eventReq.getHeaderFirstValue(Constants.X_LARK_REQUEST_TIMESTAMP);
    nonce = eventReq.getHeaderFirstValue(Constants.X_LARK_REQUEST_NONCE);
    sourceSign = eventReq.getHeaderFirstValue(Constants.X_LARK_SIGNATURE);
    targetSign = calculateSignature(timestamp, nonce, encryptKey, cipherEventJsonStr);
    return targetSign.equals(sourceSign);
}`

使用key的可以通过校验，使用token的不能通过。我理解两个事件应该是一样的处理鉴权的逻辑，有人能帮忙看看吗？

Start at the two verifySign(EventReq eventReq) methods shown in the issue and compare their use of verificationToken, encryptKey, and calculateSignature. Reproduce validation with the same key and token for event callbacks and card subscriptions; done means both callback types consistently pass signature verification with matching configuration.