4.0.0

BREAKING: use sha256 for signature verification, as per https://developer.amazon.com/en-US/docs/alexa/custom-skills/host-a-custom-skill-as-a-web-service.html#check-request-signature. fixes #68
update sinon and unroll dev deps

3.0.1

fix engines field in package.json

3.0.0

BREAKING: publish as a pure ES module
BREAKING: only support node >= 12.17
BREAKING: switch to es6 everywhere
update tap dependency