The sigstore organization provides a Gradle plugin that can be used to sign artifacts before publication.

Looks like a good tool to integrate (maybe one day it will be used everywhere).