They are also signed with the senders private key. This creates added security where it becomes more difficult for an attacker to pretend to be a user, as the lack of a private key signature indicates a non-trusted user.
These messages are also verified using the sender's private key. This adds an extra layer of protection, making it harder for an imposter to pose as a legitimate user, as the lack of a private key signature implies a malicious actor.