If a friend wants to send me his S/MIME CA certificate containing his public key, why does he need to add a digital signature? A digital signature verifies that the content was sent by him and not a man-in-the-middle who has put his own public key in the email. But since we are now talking about a CA certificate (which is signed with the private key of the CA itself saying "yes, this public key belongs to email address yxz") and not just a raw public key, I think a digital signature by my friend is not needed at all, is this right? The articles that I've read were all saying the same thing: "send a public key via email and add a digital signature". But I'm assuming they were assuming a raw public key, not a CA signed one. Am I correct to assume that a CA certificate can be safely sent via email without any encryption or digital signatures involved? I guess it's important to distinguish between a public key and a CA certificate which contains a public key. But I would like to have a confirmation by the experts since this is a sensible topic.
He should still sign the e-mail. While you are correct in saying that the certificate itself cannot be forged since it already contains a digital signature from the issuing CA it is still arbitrarily copyable.
A signature on the E-Mail (or any other document) adds the proof, that subject actually does know and control the private key and is able to use it for future secured communication.