Given your description I think this is the kind of thing that Client Side Certs are intended for. At least from the PC to server. on the server to IoT device

Given your description I think this is the kind of thing that Client Side Certs are intended for. At least from the PC to server. on the server to IoT device side there are things like Z-Wave that do something like you describe (though proprietary and not well known how secure it is, to me at least). The big issue with signing alone though is that it can leave you vulnerable to replay attacks if you don't have some method to validate that it's a new request and not an old one. Typical methods i think are time based, e.g. command is only valid for 1 minute but this requires synced clocks on all devices. Or using an always incrementing number for each command and remembering which one was last sent which is easier on the device side but only allows a single master controller unless you get fancy on the master side.