AFAIK the current client behavior is "Use signing if the server offers it". Verify that this is the case.

The client can also be configured to enforce signing (ie. reject a server that doesn't offer it). Investigate adding this option.

See "client signing" and "server signing" here
https://www.samba.org/samba/docs/current/man-html/smb.conf.5.html