My current solution uses the raw body, but thank you for the suggestion to use `file_get_contents(‘php://input’)`.
As I investigated, one thing I saw recently: On the HS side, the first name is fine as it is rendered (Yllä), but when the HS workflow was sent to my end, it arrived as `Yll\u00e4`… and then the verification failed (the generated signature differs from the sent one).
When I tried to replicate it, entering a name manually and via imports (UTF-8 character of `ö`) resulted in fine validation.