Because Signal would be better than the PGP theater. In practice, though, it doesn't matter; people are just going to use plain old email no matter what. They're not going to encrypt their findings to you.
We also got super clever reports on that same bounty program. They just sent email.
Hmm I don't see it as theater if you are unable to intercept and decrypt my message. Or forge my signature, etc.