I think it would be a good idea to include the webhook-id in the webhook payload as a required field. Consumers have an additional confirmation then that the webhook-id matches the id found in the webhook payload

For example based on the spec:

Headers:
webhook-id: msg_2KWPBgLlAfxdpx2AI54pPJ85f4W\

Request Body:

{
  "id": "msg_2KWPBgLlAfxdpx2AI54pPJ85f4W\",
  "type": "contact.created",
  "timestamp": "2022-11-03T20:26:10.344522Z",
  "data": {
    "id": "1f81eb52-5198-4599-803e-771906343485"
  }
}

Edit: rather than say required field I should of said recommended field as the payload section is only a suggestion