Anyone can create a GPG key and start signing commits. GPG does not solve identity, it requires additional networking (like WoT or TOFU) before it can begin to

Anyone can create a GPG key and start signing commits. GPG does not solve identity, it requires additional networking (like WoT or TOFU) before it can begin to function as an identity tool.