Sign + ETM in ECIES

Using ECIES in a file encryption protocol, I need to authenticate the sender, so I'm using ECDSA, and I'm wondering if signing the ephemeral public key(needed by receiver to derive the shared symmetric key) is the way to go? The goal is to prevent MitM from forging and sending a fake ephemeral public key. The code(C#) uses Inferno but it is easy to follow considering the explicit variable names and the comments:

    internal static void Encrypt(CngKey receiverPublicDhm, CngKey senderDsa, string file, string text)
{
var plainTextBytes = text.ToBytes();

var ephemeralPublic = ephemeralBundle.EphemeralDhmPublicKeyBlob;
var sharedSymmetric = ephemeralBundle.SharedSecret;

// sign emphemeral public blob and plainText(so that MitM cannot forge a fake ephemeral public key)
var toSign = Utils.Combine(ephemeralPublic, plainTextBytes);
byte[] signed;
using (var ecdsa = new ECDsaCng(senderDsa) { HashAlgorithm = CngAlgorithm.Sha384 })
signed = ecdsa.SignData(toSign);

// ETM signature and plaintext
var toEncrypt = Utils.Combine(signed, plainTextBytes);
var encrypted = SuiteB.Encrypt(sharedSymmetric, toEncrypt.AsArraySegment());

using (var fs = new FileStream(file, FileMode.Create, FileAccess.Write))
{
// so the format is:
// [ephemeral public] (signed but not encrypted)
// [signature] [ciphertext] (both encrypted and MAC'd)
fs.Write(ephemeralPublic, 0, ephemeralPublic.Length);
fs.Write(encrypted, 0, encrypted.Length);
}
}


Edited: Fixed a typo in file format description

• @Maarten Bodewes: You are right, sorry about the typo, edited and fixed. How should I have described the protocol I'm using? – Frank Dec 29 '16 at 0:51
• I guess you have an answer now, so that's all right. We try to use mathematical descriptions to describe protocols, using e.g. $\operatorname{H}$ for hashing, $\operatorname{E}$ for encryption etc. Then we define which primitive we use for - for instance - $\operatorname{E}$. But I guess this takes some reading of cryptographic papers. Pseudo code can also be used, in that case leave out things like streaming and try not to use things like SuiteB.Encrypt which doesn't really tell us too much. – Maarten Bodewes Dec 29 '16 at 10:17
• @Maarten Bodewes: Okay thanks for the precision, I'll consider this in my future posts. – Frank Dec 29 '16 at 20:52