I'm confused about what the benefit of a malleable cipher is if you still have a HMAC. Is it just for Alice or Bob to be able to say "that's our ciphertext but not our symmetric key"? But in that case the HMAC would also need to be forged, right? If Eve publishes the ciphertext and the legitimate plaintext and the legitimate key, wouldn't Alice and Bob have to say "that's a forged HMAC" with a malleable cipher versus…
The signing key gets published right after the recipient verifies the message with it. Also, the signing key is derived from the encryption key, so you always know the former if you know the latter.