MAC-then-encrypt in SIGMA protocol for authenticated key exchange The SIGMA protocol proposed in 2003 and used in TLS 1.3 and IKE stands for &quot;SIGn-and-MAc&quot; and can optionally protect identity using encryption.
The SIGMA-I variant illustrated below indicates that it uses a MAC-then-encrypt approach:

Here $\{\dots \}_{K} $ denotes encryption of the information between the brackets under a symmetric encryption function using key $K$.
Is there a particular reason to use MAC-then-encrypt rather than encrypt-then-MAC for key exchange protocols? I wasn't able to find a better answer than it seems arbitrary when looking at a comparison between MAC-then-encrypt and encrypt-then-MAC.
Edit: RFC 7366 linked in this related answer gives some hints that encrypt-then-MAC should be preferred (D)TLS communication (none is said about handshaking). In particular, it  states:

TLS and DTLS use a MAC-then-encrypt construction that was regarded as secure at the time the original Secure Socket Layer (SSL) protocol was specified in the mid-1990s, but that is no longer regarded as secure.

Interestingly, H Krawczyk (the author of SIGMA) wrote in 2001 The Order of Encryption and Authentication for Protecting Communications (or: How Secure Is SSL?)—before SIGMA.
Arnaud asked me to clarify this issue.
It is true that one should use an authenticated encryption mode or encrypt-then-MAC, and the paper says that explicitly. Indeed, the explanatory text in the paper following the figure shown above (Section 5.2 of https://webee.technion.ac.il/~hugo/sigma-pdf.pdf) addresses this issue.
It says:

We stress that the encryption function (as applied in the third message) must be resistant to active attacks and therefore must combine some form of integrity protection. Combined secrecy-integrity transforms such as those from [16] can be used, or a conventional mode of encryption (e.g. CBC) can be used with a MAC function computed on top of the ciphertext [3, 26].

Namely, the encryption denoted  $\{...\}_{K_e}$ needs to use an authenticated encryption scheme. (The need for authenticated encryption is also repeated in Appendix B that shows a more complete protocol in the form of SIGMA-R).
The fact that there is a MAC (on the identity) under the encryption is just because the MAC is (an essential) part of the SIGMA protocol and is completely unrelated to encryption (in particular, needed even if you do not care about protecting identities). So while it looks like &quot;MAC-then encrypt&quot; it has no relation to this mode of encryption.
Note: The reason the text says that authenticated encryption is only needed for the third message is that, as said at the beginning of that same paragraph,  SIGMA-I protects the identity of the initiator from active attackers and the identity of the responder from passive attackers.   So encrypting the identity of the responder only needs security against passive attacks for which UNauthenticated encryption suffices. This is really an academic remark since in practice one would use the same encryption scheme for both flows, namely, authenticated encryption for both.