A signature also needs to have the date. The author is already taken care of via npub but without the date and something that proves the timestamp accurately like OpenTimeStamps, then you could forge a message to be sent from the past.