Signatures only appear in the Signal protocol for prekeys, which allow limited asynchrony [1]. Signatures are not necessary for synchronous E2E with PFS. [1] T

Signatures only appear in the Signal protocol for prekeys, which allow limited asynchrony [1]. Signatures are not necessary for synchronous E2E with PFS. [1] The basic PFS key exchange is a triple DH: ee, es, se (e=ephemeral key, s=static key). This is obviously a synchronous protocol, because the ephemeral keys need to be exchanged for the handshake. X3DH works around this by publishing a bunch of unused ephemeral keys in advance. Those are signed. Note that the signature is not necessary for the protocol to be secure per se, the triple DH gives you mutual authentication already. The signature is only there to prevent the prekey-exchange-server from publishing prekeys for arbitrary clients and then decrypting initial messages using those ephemeral prekeys after compromising the corresponding static key. So the purpose of the signature is to close a loophole weakening PFS when you publish ephemeral keys in advance. X3DH also has a few other subtleties due to this, so it should only be used if you really need an asynchronous handshake. Otherwise, normal triple DH (Noise_XX) should be used instead.