Before depending on GnuPG, create test keys and exchange an encrypted file with another person. Verify signatures, expired-key behavior, and what the recipient sees when the wrong key is used. Decide how you will authenticate public keys instead of trusting an unverified import.
The hard part is key lifecycle: backup, rotation, revocation, and recovery after device loss. Write down those procedures and practice them with noncritical data. Encryption is only useful when authorized people can still decrypt what they need and compromised keys can be retired.
Akousa