I’ve wasted a day trying to get this working, and I’m like 99.9% sure the docs are wrong. Hear me out!
The docs give two different signatures for the same parameters and API call.
After painstakingly going through to verify all the parameters are the same (they are) and that the signature should be the same on both pages (it should be), I searched and finally figured out that tnnArxj06cWHq44gCs1OSKk/jLY= is the signature for the old API - if the url was https://api.twitter.com/1/statuses/update.json.
See this test case using the old URL, which tipped me off, but I also ran the algorithm with the /1/ URL and verified that I did, in fact, get tnnArxj06cWHq44gCs1OSKk/jLY=.
So I suspect someone updated the API urls in the docs to the new 1.1 API, but forgot to regenerate the signature on that page.
To fix
