Why wouldn't that be legal? Obviously you should be using S/MIME or GPG if you're worried about fraud but it's not like hand signatures are all that secure.
A contract is only valid as long as both parties stick to it. If there's a disagreement, it's up to a court to figure it out. That's where you get into risk mitigation. If you are comfortable with a court making a determination based on an exchange over email, then great. Courts see email as a valid form of proving one's identity. If you want to go further to reduce the risk that a court invalidates the contract, you can do things like having witnesses, wet ink, notaries, etc. Obviously for a contract with low material value, it's not a big deal. Signing a multi-million dollar contract? People start taking whatever measures they can to ensure things are air tight.
A lot of tech people think risk mitigation is only verifying somebody's identity, but a court could decide a contract is invalid because the person signing it had no idea what was inside. So there's a lot more to it.
There is in fact a U.S. law that defines “writing” in some parts of the law to encompass electronic communication in some manner as well. So some federal laws that required certain kinds of agreement to be in “writing”, like, IIRC, exclusive copyright licensing, now permit electronic communication.