I think that by encrypting the message the content will be hidden; and then if I sign it, it will be authenticated
- Content is hidden from adversaries not knowing the symmetric key.
- Origin of the ciphertext is authenticated, and verifiable by any third party.
- Origin of the plaintext is not authenticated, much less verifiable by a third party, unless we add hypothesis
- Whoever needs to authenticate the plaintext knows the symmetric secret key
- and it is assumed the integrity of the symmetric secret key used by both
- the sender/signer
- and whoever needs to authenticate the plaintext.
What could happen is that an adversary (or accident, poor practice) manages to garble or de-synchronize the symmetric secret key used by sender or receiver/verifier. If the encryption is with e.g. AES-CTR, the receiver will end with an incorrect but trusted plaintext. In many contexts that's an effective denial of service; in some others, a successful attack.
These issues are solved by signing, appending signature, then encrypting (critically, the signature must be encrypted). An important advantage is that a third party can authenticate the message after decryption without needing to be given the symmetric key.
Note: using authenticated encryption in the original scheme tends to remove requirement 2 in practice, but does not in theory: authenticated encryption formally assumes integrity of the symmetric key on the receiver side. An authenticated encryption scheme would arguably still be considered secure if it was feasible to exhibit a key that allows verification of a message produced under a different key, and which deciphers differently with the exhibited key than it does with the original.