What must be verified on incoming requests to confirm they truly came from Slack?

Slack applications receiving HTTP requests must verify Slack's cryptographic request signature using the application's signing secret. Slack includes an `X-Slack-Signature` header and request timestamp with signed requests. The application constructs a signature base string from the timestamp and raw request body, calculates an HMAC-SHA256 signature using its signing secret, and securely compares the calculated value with Slack's supplied signature. Developers should also validate the request timestamp to reduce replay-attack exposure. This provides strong evidence that the payload originated from Slack and was not modified after signing. Country information and browser user-agent strings provide no cryptographically reliable authentication, while the workspace's subscription plan is entirely unrelated to request integrity. Slack recommends signing-secret verification instead of the deprecated verification-token approach. Therefore, B is correct.