Let's say I own a service and a client needs me (for the sake of this question) to provide an endpoint over HTTP (not HTTPS) that doesn't use cryptographically secure authentication. Further, there's no limit on who's authorized to call the endpoint.
This endpoint will accept some parameters in its request body and return digitally signed payloads in its response. The client would have my public key certificate prior to calling the endpoint.
What are the risks in returning digitally signed payloads over an insecure HTTP connection?
ipsechad nothing to do with your problem and thus I've removed it.