PGP is 2048 bit encryption? That a whole lot more than 128 bits. But, I thought 128 bits is more "serious" and "legit"
There are two different concepts at play here:
Key Size is the size of a key on disk, measured in bits. For RSA encryption you tend to see key sizes like 2048 bit, 4096 bit, etc. For Elliptic Curve Cryptography (ECC), you tend to see key sized like 224 bit, 256 bit, 384 bit etc. For AES, 128 bit, 256 bit.
Key Strength is a measure of how much computation an attacker needs to do to break your key (ie compute the private key from the public key). In crypto research papers you tend to see sentences like this:
Breaking an RSA 2048 key requires, on average, 2112 operations.
This key is said to have "112-bit security".
Symmetric block ciphers like AES tend to have the property that the key length is the same as their security level (note that this will no longer be true once quantum computers are here). Here is a table from NIST that shows relative security levels for various RSA and ECC key sizes.
Of course, as mathematical research progresses and we find more efficient ways of attacking the underlying math, the number of bits of security provided by your 2048-bit key will go down.
Why 128-bit security?
For an intuition on how long it would take you to make 2128 guesses at something, check out this youtube video:
Cryptographers like things that have >= 128-bit security because it's comfortably in the "not in my lifetime" category. When something gets below 80 bits of security we start looking for something bigger to replace it with.