Why GPG?

Universal, used broadly for signing. Easy to verify signatures. More and more projects use it. You can sign messages in case the website is compromised - trust hooks are the most important, place the key and/or its fingerprint on github, on nostr on the website, let people fetch it for the future, use webarchive to save the fingerprint (time based trusthook). Sign rotated keys with an older key, attach the fingerprint inside the zapstore itself (Putty project does exactly that, attaches the FP inside the binary for yet another trust hook)