Say we have Alice and Bob.
Alice sends Bob a message she encrypted with Bob’s public key. Bob is the only person who can decrypt it, using his private key. But how can he be certain the message came from Alice?
Suppose he replies, encrypting his message using Alice’s public key. Only Alice can decrypt the message. But how can she be certain it was sent by Bob?
Would Alice have to add some kind of public hash to her message so bob can say “This definitely came from Alice?”
Bob has Alice’s public key also, and Alice signed the message with her private key. Bob uses Alice’s public key to verify the signature.
Go in reverse for Alice to ensure the message was from Bob.
All you have to do now is make sure that Bob has Alice’s real public key and not one injected by a man in the middle.