Every transaction starts with an Externally Owned Account, and it's signed by somebody. When a contract calls another contract, some people call it an "internal transaction", but it isn't actually a transaction; It's part of the transaction started by an Externally Owned Account. It's more accurate to refer to it as a call. The same transaction, with a single signature, may include multiple other contract-to-contract calls.

A call doesn't need to be signed. The called contract automatically has access to the identity of the contract that called it in a variable called msg.sender, so if it needs to make authentication checks it usually looks at that.

Every transaction starts with an Externally Owned Account, and it's signed by somebody.

As part of that transaction, a contract may call another contract, and some people call this an "internal transaction", but an "internal transaction" isn't really a transaction; It's part of the transaction started by an Externally Owned Account. It's more accurate to refer to it as a call. A single transaction, with a single signature, may include multiple contract-to-contract calls.

A call doesn't need to be signed. The called contract automatically has access to the identity of the calling contract in a variable called msg.sender, so if it needs to make authentication checks it usually looks at that.