Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With zero annotations the description carries the full burden, and it does add real behavioral value by disclosing that a signing secret is returned and what that secret is for. However, it says nothing about permissions/auth needed, whether subscriptions are idempotent or additive, whether event delivery is retried, or what happens when the URL is unreachable.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.