GPG is “well-established” in the sense that it’s old; it’s not considered a modern or well-designed digital signing (or encryption, or trust distribution, etc.) scheme.
I think there are significant issues with establishing the “authenticity” of digital artifacts in any scheme, but GPG would probably make things worse rather than better here.
I think there are significant issues with establishing the “authenticity” of digital artifacts in any scheme, but GPG would probably make things worse rather than better here.