Well, the problem could be that you are taking a less useful definition of the purpose of a signature. Definition 1 (yours): given a message and a signature, y

Well, the problem could be that you are taking a less useful definition of the purpose of a signature. Definition 1 (yours): given a message and a signature, you can derive the signing key and prove whether that key signed the message. Definition 2 (sophie's): given a message and a putative signing identity, you can prove whether the given ID signed the message. Since you are always free to include identity with the message, the second definition has a strictly greater scope of application.