I gave up. I'm just logging each notification and then checking new notifications against the existing ones. I also learned something interesting - for customers other than the developer, the customerID reported in the webhook push doesn't match the customerID when validating transactions.
So, in summary, to process a webhook push:
1) I check to make sure I haven't received it before
2) I validate the transaction with Roku to figure out the "true?" customer ID
3) I do what I was planning on doing with it
If we could get a hold of someone familiar with this codebase within Roku, that would be awesome. Steps 1 and 2 are an unnecessary waste of resources for both us and Roku. #1 should be easy to fix (they just need to document "accepting" webhooks better. #2 is a bug and likely a security issue. I am guessing that they are doing something to mask "real" customer IDs and it is not correctly implemented on the Roku push notifications.