Context
At the moment, if you use this action and have the Require signed commits setting enabled for a protected branch, the PR generated can't be merged.
Example
Crowdin, a popular localisation management tool, has a similar action which opens a PR using a bot.
They allow you to pass a gpg_private_key as a config option, which will enable signed commits for the bot opening the PR. See options here.