You can now use SSH keys if you so wish.

• https://docs.gitlab.com/user/project/repository/signed_commits/ssh/
• https://docs.github.com/en/authentication/managing-commit-signature-verification/about-commit-signature-verification#ssh-commit-signature-verification

GnuPG is one of those tools I never got around to use. How could something designed for human communication be so utterly cumbersome and confusing ?