If a friend wants to send me their S/MIME CA certificate containing his public key, why does he need to add a digital signature?
A digital signature verifies that the content was sent by him and not a man-in-the-middle who has put his own public key in the email. But since we are now talking about a CA certificate (which is signed with the private key of the CA itself saying "yes, this public key belongs to email address yxz") and not just a raw public key, I think a digital signature by my friend is not needed at all, is this right? The articles that I've read were all saying the same thing: "send a public key via email and add a digital signature", but I'm assuming they were assuming a raw public key, not a CA signed one.
Am I correct to assume that a CA certificate can be safely sent via email without any encryption or digital signatures involved?
I guess it's important to distinguish between a public key and a CA certificate which contains a public key. But I would like to have a confirmation by the experts since this is a sensible topic.