GitHub signs web-created merge and squash commits with its GPG key. But Rebase and merge rewrites commits without signing the replacements, so your original signatures do not survive. GitHub documents this in its signature verification guide.
The workaround: merge your signed commits locally with --ff-only. Your branch must be up to date with the target branch, contain signed commits, and already be pushed with an open PR. From the target branch, run:
git merge --ff-only <branch>
git push
A fast-forward preserves the existing commits and their signatures. GitHub recognizes those commits and marks the open PR as merged, as explained in this community discussion. If you rebase first, sign the rewritten commits and push the PR branch before merging.
This requires permission to push to the target branch and compliance with branch protection.