Wouldn't it be more efficient if the client initiated the connection by generating their own message, and encrypting it using their private key, then sending both messages to the server so it would decrypt and compare the messages?
This would essentially allow for a replay attack. Capture the messages, and replay at a later time. To avoid this the server would have to store all previously seen values, to ensure no reuse.
However, by making the server send the nonce, and making it sufficiently big, we can be fairly certain that someone in fact posesses the key if the can return a reply that matches the nonce.