Are you planning to use GPG and sign news and releases? For example Electrum wallet does that

Why GPG?

Universal, used broadly for signing. Easy to verify signatures. More and more projects use it. You can sign messages in case the website is compromised - trust hooks are the most important, place the key and/or its fingerprint on github, on nostr on the website, let people fetch it for the future, use webarchive to save the fingerprint (time based trusthook). Sign rotated keys with an older key, attach the fingerprint inside the zapstore itself (Putty project does exactly that, attaches the FP inside the binary for yet another trust hook)

We are trying to make cryptographic asset verification easier with Zapstore, GPG has many documented issue. I think less and less projects use it. Kind of pointless on Android too and even more so when we link the keystore to a nostr keypair