Publishing to maven central isn't particularly difficult, but it is a high friction process.

You have to file an issue on a JIRA board.

Provide proof of owning a namespace(dns txt record, or github).

Wait for a human to review and approve the ticket.

Create a PGP key.

Publish the PGP key to public key servers.

Submit your builds via the webapp.

Wait for the verification process to complete.

Have it fail a bunch of times randomly, because despite uploading your PGP key to as many of the keyservers as you could, there seems to be a huge key replication delay between keyserver instances, and the verification process can't find the key published.

Once verified, actually publish the build.

Most of the pain is one off, once you have gone though it, publishing new builds can be automated.

The PGP signing is pointless, you can sign with any key you like, and change the key as often as you like, just so long as the key is published. 10 years in the industry, I have never heard of anyone checking the signatures on maven artifacts.