They should be secure random strings, no need to sign.

BTW, rails signed session cookies are terrible from a security perspective. Thank god Github has moved away from them.