No need to sign. Just reveal the private key. The goal is account recovery not signing security. 

The phone of a homeless person will be either stolen or lost every other month or so. They can get new phones, they just need a way to go somewhere and recover their accounts. :)