The beauty with DH based schemes like Noise is that when Alice sends a message to Bob, Bob doesn't quite get a cryptographic proof that Alice sent a message. Bo

The beauty with DH based schemes like Noise is that when Alice sends a message to Bob, Bob doesn't quite get a cryptographic proof that Alice sent a message. Bob gets a cryptographic proof that Alice or Bob sent a message. Bob only know it came from Alice because he did not send the message to himself. He could have, though. So he can't (cryptographically) prove to the rest of the world that the embarrassing message really came from Alice. At best, he can prove that the message came from [Alice or Bob], but he'll have to disclose his private key to do it. But as soon as he discloses his own key, anyone can forge messages to him. (Note: it is possible, still without using signatures, to make sure Bob is not fooled by forged messages from the outside even if his key was leaked: he only have to provide a freshly generated ephemeral key pair into the mix, which necessarily hasn't leaked yet. This provides what we call Key Compromise Impersonation resistance, so we can't force Matrix goggles on him just be cause we stole his key. Unfortunately, this requires Bob to provide that ephemeral key, and that only really works with online protocols. On a PGP-like system, this means that we have to chose between deniability or KCI resistance: if you use signatures, you lose deniability, and if you use only DH, you lose KCI resistance. My personal opinion is that one should be responsible for their own keys. Therefore, I'd sacrifice KCI resistance before I sacrifice deniability.