Validate payload signatures in fake registry

In #168 I introduced a fake registry to be used for integration tests. This registry is a basic HTTP server that returns OK if the data is properly parsed.

To have a better E2E validation workflow, we should explore adding payload signature validation to this registry.

Review the fake registry implementation introduced in issue #168 and trace how integration and E2E payloads reach its HTTP handler. Clarify the signature format and validation requirements, then consider the work complete when the registry rejects invalid signatures and accepts valid ones in the E2E workflow.

Written by the indexing model from the issue text.