Linux distributions that use PGP are effectively closed key ecosystems, meaning that their use of PGP is purely incidental: you trust the key material because t

Linux distributions that use PGP are effectively closed key ecosystems, meaning that their use of PGP is purely incidental: you trust the key material because they come from trusted sources or baked into your distribution, not because of any of the behavior that PGP supplies. PGP is strictly a liability in these contexts: it's more malleable and allows third-party signers to make mistakes that a reasonable codesigning scheme does not. In other words: each of these distributions could switch to bare signing keys tomorrow, and nothing would change (other than being able to delete a massive pile of insecure GPG code).