They do, and they are signed, but they still have issues like this which are so easily mitigated by just using a goddamn server.
But still, if your frontend hosts can't reach your database, you have far bigger problems than your sessions not working.