This is the other way around. It allows the user (token holder) to sign messages "using" the ID token. To be able to sign a message you not only need the ID to

This is the other way around. It allows the user (token holder) to sign messages "using" the ID token. To be able to sign a message you not only need the ID token but also the private/signing key, and the corresponding public key is bound to the ID token (using the nonce field). Thus you can prove that not only did Google say you are you, but you possess the signing key associated with the ID token that says so. Thus I can be sure someone else didn't just steal your token in flight or from a log file for example.