I've implemented what I believe works for the shop/redact. Because, when I uninstall my app, my shop/redact gets triggered, as per docs, 48 hours later. My app's webhook metrics also show 0% failed delivery rate.
However, when I submitted my app for review. I saw a call to what seems to be shop/redact judging from it's payload, where hmac failed to verify. The shop is from a Shopify app reviewer, so I think the call is legit.
I've seen a lot of similar entries in my logs - like, a whole spate of malformed requests in a row. I think they're automated tests that check things like whether the app correctly validates HMAC signatures.