Gpgtools GPGServices

I was wondering, what is exactly in the attached file, when i send an email, that was encrypted and signed before. So i opened the file and tried to decrypt the file and it was decrypted successfully. Then i opened the file and i could see the email, with the sent message and the signature...

Now i try to understand how this can be safe. In my understanding, a message should be signed, to verify the sender. When i receive an encrypted message, with the signature encrypted inside, i have to decrypt the message before i can verify the sender (as i dit in fact in my testing example). But now i can not be sure who is the sender and therefore i can not be sure, whether it is secure, to decrypt it. Wouldn't it be much better, to first encrypt a message?

Also i repeated the test with Thunderbird / Enigmail and here the result is, that OpenPGP tells me, after (or before?) decrypting file, that the file is signed. Then the decrypted file does not contain the signature.

This looks much safer to me.

I use Apple Mail 10.3 (3273) with GPGMail 2.7b3 build 1215b