I'm using Paypal Direct (not Standard).  Everything worked great during sandbox testing, but when we rolled out and I un-ticked "use sandbox" for Paypal Direct, I found that all of my IPNs were getting reported as invalid.  The problem was that PaypalIPNHandler.aspx always uses the "use sandbox" value from the Paypal Standard configuration (which was still set for "use sandbox" because I was not using it).