> [...] I can't find a Python library for validating the signature. Not even AWS's flagship API client (boto3) has the functionality.

I wrote validatesns [1] for this, give it a try!

(Not sure why there's an official PHP validator but not Python...)

[1] https://github.com/nathforge/validatesns