Also, minisign, signify, sigstore are all much better than gpg for the problem of signing packages.