electrum PGP Signature verification ensures that you have not downloaded electrum from an unknown source, which is often a scam, which means that once you install the application, connect the hardware wallet and click on the message signature button, they may be able to access all of your coins, modify the balance before signing, and show false data.
as we can know how this scam app works, but it will inevitably lead to you losing all or part of your balance, so try to verify the signature to ensure that you have downloaded the correct electrum.
You are correct. PGP signature ensure the authenticity of a file or a message. If I send you a signed message, you can verify it to be sure it was me who sent it.
However, even if you download a fake app and connect your hw device to it, It won't be able to access your coins. It can change some data like the recipient address and the sent amount but it still need your confirmation to sign the transaction. All the information will be displayed on your hw device screen before you click on the confirmation button.