After consultation with a very senior Solution Engineer I found my answer, which I will provide with two parts to the answer for better understanding and documentation for future searches around this:
- No, PGP encryption of e-mails doesn't work (or likely any other means). It's kind of plausible because this would have a massive impact on the sending infrastructure. It's likely to rare a use case to bother with development at this sort of scale. Totally understandable to be honest ...
- "Digitally Sign Messages" in the documentation refers to S/MIME, which allows to sign messages with a digital certificate that ensures the sender is correct and the message is not tampered with. From what I understand this is basically another layer on top of DMARC for increased trust.
I was warned though, that the S/MIME feature is a very old one and there is no guaranteee that it still has full support on all the various send methods now available.