Both are useful. GPG is good for signing, particularly when that signature is written into some form of immutable history (e.g. git). That signing key can be r

Both are useful. GPG is good for signing, particularly when that signature is written into some form of immutable history (e.g. git). That signing key can be revoked or time windowed to expire. There are mechanism for distributing that revocation and its validity at the time of signing can be verified at any point in the future. SSH keys are excellent for authentication. They are simple to verify at the time of use, and can also be revoked or for a specific system or usage context. Using these short-term keys for potentially long-term proofs is going to lead to some avoidable pain IMO.