Enable the signature of your patch file with just adding "-pgp" or "-sign" to the GenPatch arguments. This will create a .SIG file with a signature of the patch file using your default private key and the "pgp" found in your system path first. You can choose to provide.
If pgp is not in your system path or you want to use a different one you can use "-pgp-path=path/to/pgp" to tell GenPatch what executable to use. You can specify a directory in which case, GenPatch will look for an executable "pgp" in that directory or you can give a full path to an executable of your choice.
If you find that the default filename for the signature (patch base name with .SIG appended) you can change the default using the "-ppg-output=filename" option of GenPatch. You can use "%" as a shortcut for the base name of the patch file. If e.g. your patch file is name test.utp, the default of "%.SIG" gives you signature file "test.SIG" and "prefix_%_postfix.ext" would give "prefix_test_postfix.ext". You may use "%" any times in your filename template if you wish to e.g. have is used in a path portion.
If you want the pgp to use other than the default parameters "-sba" then you can change it with "-pgp-args=options" to whatever you like. Note that the "-o" option must not be used in this context and the resulting filename must be controlled by "-pgp-output" instead if desired. We designed it that way, so you can make your default settings using both options and override only what you need to when you actually create your patch files later.
The pgp called does quite a lot output. Some of which is informative, but you may not want to see it. In that case use the "-pgp-quiet" option to suppress the Genpatch output.