We've added signatures to avoid doing expensive permission look-ups against cassandra for each preview/thumbnail we load on the page. We shouldn't be doing any queries at all in order to display an image (we're currently doing 1 to check if it exists, but that can be removed once the deterministic file storage goes in) If we are retrieving the content item when validating a preview signature, I think there might be something wrong.

Another reason to add the lastModified timestamp is to bust the browser cache when a preview/thumbnail/profile picture is updated.