The signature replaces the handshake for authentication; silent-drop + cheap-first validation (~2 µs before ~50 µs verify). We can also obviously requre PoW for rate limiting if it becomes an issue. The fingerprint problem is won by having no handshake at all. A TLS handshake might cost the victim 35ms, plus round trips. That is maybe 700-4000x more expensive. The flood problem is handled by making every forged packet cost the attacker more than it costs us — and by never letting a forged packet create state, a response, or a signal. Bottom line, it's really cheap to check the incoming packet and do nothing compared to handshaking. But we will see.