Yes, you are right. But if you imagine the full provenance of a lot or serial tracked item having hundreds of "messages", it is true they could all be digitally signed by the entities submitting them which would prove "who" sent the "messages".

However, keep in mind that all these messages need to be correlated and subject to business logic and validations. For example, the business logic might dictate that one cannot record a temperature reading to the blockchain if the chain-of-custody does not show you as the current possessor of the item.

Alternatively, the business logic may say that you cannot blend a non-blendable lot.

There are thousands of business rules that need to be enforced along the way.

With the (say) PGP approach, you would need to ADDITIONALLY trust that the entity applied these business rules correctly. Also in this approach, there is no single version of the truth. So, every entity maintains its own version of the truth leading to huge synchronization problems in addition to trust problems.