It can be used to encrypt / decrypt messages (for e2ee messages like email), but also for signing data. For example code I commit to repositories is signed using my gpg key. If you want to verify that a commit was indeed pushed by me, you can verify the signature on it.

Many developers sign their releases as well. For example when you download Sparrow Wallet you can get an additional signature file to verify that the release was indeed created by nostr:npub1hea99yd4xt5tjx8jmjvpfz2g5v7nurdqw7ydwst0ww6vw520prnq6fg9v2