Purpose of signing the signed prekey in X3DH? I'm trying to understand the X3DH protocol used in Signal and many other end to end encrypted messaging apps. There are other questions on this site asking about why the signed prekey exists. I'm asking why the prekey need to be signed.
In section 3.3 of the specification, 4 (3 if the one-time prekey is missing) Diffie-Hellman exchanges are done. DH1 involves the identity key of one user, and DH2 involves the identity key of the other user. The SK is derived from these exchanges in addition to the other exchanges that do not involve identity keys. Notably, DH4 is computed without involving any identity key or signed key.
How does any security property of X3DH change if the signature on the signed prekey is not validated?
section 4.5 of the spec:

It might be tempting to observe that mutual authentication and forward secrecy are achieved by the DH calculations, and omit the prekey signature. However, this would allow a &quot;weak forward secrecy&quot; attack: A malicious server could provide Alice a prekey bundle with forged prekeys, and later compromise Bob's IKB to calculate SK.

in other words:

you want to talk to Bob for the first time
you ask me (the server) what are Bob's keys
I give you:

his real identity key
an unsigned prekey of my own
no one-time prekey


you do the X3DH with this information, and send Bob messages (making use of the output of X3DH)
unfortunately, Bob won't be able to decrypt any of these because the X3DH is not using an unsigned prekey he knows.
later on, I manage to compromise Bob's identity key, I get to decrypt the messages you had sent him at the time. Thus, there is no forward secrecy for these messages that Bob couldn't decrypt (thus, &quot;weak forward secrecy&quot;).