Signing it doesn't mean it wasn't altered at some point and does nothing to actually verify the content - only if a source is who they say they are. And the key distribution is another issue.