A certificate is public data; people keep showing them to each other. When you talk to a SSL server, one of the first things that the server does is to show his certificate. To anybody.
Thus, showing a certificate does not prove your identity. What matters is the private key. The private key is not in the certificate(*). By computing a signature, you demonstrate mastery of the private key, i.e. you show that you are yourself.
The certificate itself is a container for the public key. When I look at Google's certificate (the one they use for their servers), I can validate it (against CA's public keys) to gain some assurance about the certificate contents, which really amount to: "this public key is owned by that entity". I thus learn Google's public key. However, it does not tell me at all that whoever handed me that certificate is Google ! Everybody can obtain Google's certificate; you can even see it in your Web browser by merely connecting to their server. What tells me that I am indeed talking to Google's server is that the server appears to be able to produce a valid signature on a challenge I am sending to it; and I can verify that signature with Google's public key (and I know Google's public key thanks to the certificate). Being able to produce a valid signature requires knowledge of the private key -- in that case, Google's private key, which, as the name implies, is known to Google only.
(*) There is a considerable amount of confusion implied by some people who call "certificate" what really is the certificate AND the corresponding private key. Terminology sloppiness is unfortunately widespread.