Signed responses — do I have to check the signature?

HTTPS proves you talked to us. The signature proves the answer you're holding is the one we gave, and the nonce proves it isn't one we gave an hour ago being replayed at you.

If the answer never leaves the request that fetched it, HTTPS alone is close enough. The moment you cache it — and you should — check the signature, because a cached answer is exactly what's worth tampering with.