It's a common need to prove that a file is truly created by someone, and I think GnuPG did the job. However, anyone can generate a gpg key with an unverified email. GPG key servers doesn't verify my email address at all. Is there any CA that provides identity validation like signing a HTTPS Certificate does?
You can either go to a certificate signing party or get an X509 certificate for you PGP key and get it verified by a CA trusted by all parties involved.
Any certificate and private key can be used for signing a message, but it's a matter of whom your sending it to that should verify that trust.
Yes, it is arbitrary to create a false key and publish it, however if you truly wanted to verify whom you were speaking with and they wanted to verify you, you should first provide that verification out-of-band.
Meeting them in person in the ideal way to exchange your GPG identity, but you can also do this in any trustable way that you can verify you are speaking with the intended person. Setting a security phrase during a personal meeting and using that over a phone-call is one way. Using something like Signal where you have verified each other's keys is another great way to do it.
A CA doesn't necessarily imply you are who you say you are. As pointed out, an unverified email can go a long way.
Ppk Infrastructure technically proves only tha a certain key has been used to apply a signature. You need an organisational trust applied to the technology to receive proove of identity.
If you have a key published and signed and it gets compromised, technology wise the system of signature validity is not broken. Yet, in reality, the identity mechanism is now void. You suffered identity theft. This leads to the question as how you secured your identity token in your organization. And how trustworthy is this for the parties involved in the trust relationship for the files you protect.