Ya, they are, but with SSL you don't risk any kind of mitm shenanigans..

I spent some time verifying that nostr apps do check sigs. All the ones I checked except for damus check sigs.. it's a good thing to verify this in your clients, easy for devs to skip it to make a faster feeling app.