Alice and Bob have a pre-shared long-term Ed25519 key used for veryfying/signing ephemeral keys.
They have a shared key which resulted from the DH exchange. They compute HKDF SHA256 of the shared key to use as the AES GCM key.
Should they sign the cipher to make sure a man in the middle didn't change it? If yes, is it safe to send the cipher + signature + HKDF salt in the same message?