There are multiple ways to handle this.

None ideal.

My way: have a client and a server. The client connects to the server. The server signs notes, not the client.

You can send some sort of creds, id or other way to authenticate over radio.

I did this to save bandwidth mainly. The sig could be done client side, but then you are adding a ton of data and bytes.

The purpose of the signature isn't to obscure a message, rather prove identity/ownership. I see no reason this isn't legal in almost all if not all jurisdictions. But I'm no attorney.