They are also signed with the senders private key. This creates added security where it becomes more difficult for an attacker to pretend to be a user, as the lack of a private key signature indicates a non-trusted user.
They are also confirmed with the sender's private key. This increases security since it becomes more difficult for an attacker to pretend to be someone else, as the absence of a private key signature indicates a non-verified entity.