Is our public key the correct thing to be signing? There's no guarantee that the remote client has received this key yet, so it wouldn't always be possible for the remote client to know that this message belongs to the current session.