What use is signing a reboot request if the bytes are the same every time? At that point it's just a secret and might as well be random, rather than a signed request. (If you're going to use signing, include a timestamp and/or request id for replay prevention.)