Justin.MadIrish.net

Public key encryption (or asynchronous encryption) is pretty tricky stuff. Encrypting a message provides confidentiality, signing provides assurance. If I sign a message the message is hashed and the hash is encrypted with my private key. This 'signature' can be verified by anyone with my public key - a process that proves the holder of my private key signed the message and that the message (and signature) have not been altered since I sent the message. So I sign all my messages so you can verify that the message came from me and not some impostor. Because e-mail doesn't provide any native verification there's really no way to tell if an e-mail from my address is really from me without digital signatures.

Encryption just takes the message and encrypts it with the recipients public key. So Evil Eve could write a message and send it so that it looked like it came from me and encrypt it with your public key. The message is encrypted, so nobody but you can read it, but you can't know that it was me who sent it. However if I sign and encrypt the message, then it is signed with my private key (which you can verify) and encrypted with your public key (ensuring confidentiality). Doing both insures integrity assurance (you know the message came from me and
hasn't been altered) and confidentiality.