The state is the authentication here. For stuff that is only sent once you can check the signature and you are done. Otherwise you have to maintain it for the duration of the connection and you are not going to want to sign every single message sent.