IMO the problem is that you need a mainstream way to store the keys that even your grandmother could use. Mainstream can’t be expected to manage their GPG keys

IMO the problem is that you need a mainstream way to store the keys that even your grandmother could use. Mainstream can’t be expected to manage their GPG keys and create, append and verify signatures manually. Though maybe in the move to the password less future with WebAuthn integrated into operating systems this may become possible.