Yep, absolutely. I said "a form of authentication" because it allows some degree of message authentication, but not to the same degree a proper digital signing

Yep, absolutely. I said "a form of authentication" because it allows some degree of message authentication, but not to the same degree a proper digital signing mechanism that utilizes public key cryptography would. The term "signing" is also kind of overloaded, and doesn't necessarily mean signing in the sense of a human signature. HMAC-SHA1 and RSA-SHA1 (or PGP) both can be said to "sign" a message, but they mean different things. Generally for web app development, I think MACs tend to suffice for the vast majority of use cases.