eli5: how does the segwit protocol verify signatures if they’re in a separate place than the block?

i’ve watched videos on it, but it still confuses me. i know that the signatures still get verified because the protocol isn’t broken, and if i want to send bitcoin from a segwit address to a legacy address that requires the signature to be within the block, it allows me to.