You're right, but also, commit signing is useless if there’s nobody on the other side verifying that the signature can be trusted. GitHub is doing that right now but that also ties projects to GitHub. It's Microsoft's way off ensuring OSS development has to go through their gates.
You can `git verify-commit` yourself. Gpg allows you to build a web of trust so you can find other people who trusts the commiter's key.