PASS - Signature-256 valid accepts SHA-256
PASS - Signature-256 invalid rejects
PASS - Signature-256 wins when both headers exist
PASS - Invalid Signature-256 plus valid Signature rejects without downgrade
PASS - Signature alone accepts SHA-1 fallback
PASS - Missing signatures reject
PASS - Header lookup is casing and Apache/PHP form independent
ALL SIGNATURE-256 TESTS PASSED