This question already has an answer here:
Let's say two users (U1, U2) each have a private key they keep to themselves, and each broadcast a corresponding public key to the world.
Let's then say that U1 wants to send a signed encrypted message to U2. I understand the idea that U1 wants to encrypt the message using his own private key, so that U2 can have proof that the message indeed came from U1 (since if U1's public key can decrypt a msg, it must've been encrypted by U1), and also U2's public key, so that only U2 can decrypt the message using his private key.
What I'm not completely clear on are the differences between first encrypting with U1's private key and then U2's public key, or in the opposiste order.
The way I see it, in the first possible order (U1 private, then U2 public), nothing can be gleaned from the doubly encrypted message by observers, even if they have both U1 and U2's public keys.
If U1 were to doubly encrypt the message in the opposite order (using U2's public key first and then U1's private key), the only difference would be that observers would be able to break the layer of U1's encryption (using his public key) and see that he sent a message (but not to whom, or at least not from decrypting that first layer). Nothing more could be observed because the decrypted message (using U1's public key) would just reveal another layer of encryption that only U2's private key could decrypt.
Is that correct? Does order matter other than that?