You really need both as the two achieve different things.
You achieve secure communications, which protect from interception/injection of data during comms.
You achieve confidence the 3rd party is both a trusted 3rd party and the 3rd party you think it is. (or in this case, a 3rd party which is trusted/authorised by the vendor).
The 1st one is pretty straight-forqward. The 2nd is a little more tricky and where many vendors have made mistakes. For example, the many IoT devices where they have used a GPG approach, but have made the mistake of using the same private gpg key on all devices.
Which type of solution you use for #2 will depend on your exact needs and risks. You need to balance the amount of protection required with the inherent level of complexity it introduces - there is no point having a really complex and highly secure solution if managing that solution becomes so complex that operational failure becomes more likely.
Consider what your requirements are and what the associated risks are to determine the minimum necessary protection and then look at how you will manage the solution and ensure this can be done without excessive burden.
There is no one right solution. It will depend on the risk profile you are addressing and how you structure things. For example, if you want the 3rd party developers to manage things i.e. the software is made available on developer managed web sites, then you probably want a signed certificate approach where you give an approved 3rd party a signed certificate and your device will only allow loading of apps from 3rd parties which have an appropriately signed certificate. This gives you the ability to revoke approval by revoking the certificate.
Alternatively, you could use an approach where you allow 3rd parties to submit applications to a site which you control. You would assess and approve the 3rd party apps and only make ones which you approve to be available on the site. In this case, you can probably just use a GPG based approach, which might be easier to manage.
The first approach would put greater trust in the 3rd parties, but would likely reduce administration overhead for you. The second would require less trust, but would create higher admin overheads for you because you have taken on a vetting role. It is also likely that there would be increased turn-around time i.e. from release of new/patched versions. However, it would also have the advantage of more control and increased quality, which may be important as the overall quality of your device may easily be judged by the quality of the apps it runs.
The two are not mutually exclusive either - you could do both, which may be warranted in some circumstances - again, depends on your risk profile and what levels of risk your comfortable with.
