I suppose one reason for prepending the name would be that a malicious Bob could pose as Alice by encrypting the exact same message + Alice's signature using Charlie's public key, and trick Charlie into believing that Alice sent him the message.
is a comment on an answer to the question Should we sign-then-encrypt, or encrypt-then-sign?. It is very interesting. I had not thought of that attack.
I wonder if instead of prepending the name, one could encrypt the message, then generate and append the signature, and then encrypt everything with the same key and send the result. Sometimes it might be convenient not to prepend the name.
