There seems to be an error in the README section Verify (https://github.com/bspk/httpsig-java#verify) and it should read "To verify an HTTP message,..." instead of "To sign an HTTP message,...".