The email associated with the key was not verified (thanks @zeripath for suggesting that might be the source of the problem).
After validating the email, I removed the GPG key, added it again, pushed a branch with a signed commit and it’s all good. Mystery solved 
