I ran into this while testing MDL-37168. Due to the way how I had ngrok and local Apache vhost set up, the OAuth verification was failing in lti_verify_message(). It took me a while to realize why and when it is happening. To get know the reasons, I had to add an extra line to the code block where lti_verify_message() catches all the OAuth exceptions, swallows the useful information and silently returns false.

I believe we should always record such problems into the error log, if we have no better way to inform the user on what went wrong.