I think the problem lies here.

"signing_key": "5mEzn9C-I28UtwOjZJtFoob0sAAFZ95GbZkqj4y3i0I" <= this is a random signing_key made up by me not something that was given to me

You need to provide a valid signature.

If you didn’t receive a webhook signing key for an OAuth 2.0 application you’ve previously created or need to retrieve one because you lost it, then contact support+developer@calendly.com.

Reference: https://developer.calendly.com/api-docs/4c305798a61d3-webhook-signatures