It is trivial to change/add an email address to your GPG keys. There is zero verification required to add any email address to a GPG key.
You will probably want to see if you can independently verify the GPG key associated with a signature you are verifying before relying upon that signature.
Ok, here's the problem. I don't know how to do any of that. If it's trivial that's probably a good sign. But how do I independently verify their signature?
Omg I just realized something that makes me feel a LOT better. I found the listing on a random website, didn't trust it and went directly to their own website to see about the job. It was there and I applied.
Ok, so anyway this is now a tech question: how do I send someone a PGP signed message on thunderbird with enigmail installed if I have a PGP signed message from a different email address?