This is the whole point of public-key signatures. Verification isn't
limited to the people who can create signatures.

This is, however, a useless feature for private email. Sometimes it's
downright dangerous.

In contrast, with public-key authenticators, verification is limited to
the sender and the receiver. The receiver can't convince anyone else
that the message was created by the sender; the receiver could have
computed the same authenticator.

What is a public-key authenticator? It's a secret-key authenticator,
with a key derived from g^xy, where g^x and g^y are the public keys of
the sender and the receiver.

If you were already planning to encrypt the message, using another key
derived from g^xy, then you don't have to do any extra public-key work.
A secret-key authenticator is easier to implement than a public-key
signature, and it takes less CPU time to compute.

---Dan