In the sense that once the server receives your payload, even via TLS, the server can change it to whatever it wants.

Signing is closer to the application than to the IP stack. But it should still happen.