Signing doesn't require I/O and can be massively parallelized. And also the CSRF token doesn't need signing, it comes from the session data stored on the serve

Signing doesn't require I/O and can be massively parallelized. And also the CSRF token doesn't need signing, it comes from the session data stored on the server. The session id is what needs signing.