What are the two actions the receiver of a PGP email message can perform that allows establishment of trust between sender and receiver?

In PGP, the message body is encrypted with a symmetric session key, and that session key is itself encrypted using the recipient's public key via an asymmetric algorithm. The receiver uses their own private key to unwrap the session key, then uses that session key to decrypt the message; the sender's digital signature is then verified with the sender's public key to establish trust between both parties.

Labeling the protected key only as a 'symmetric key' without acknowledging it was asymmetrically wrapped misrepresents the decryption step and describes an incomplete or technically imprecise process.

A recipient cannot decrypt an asymmetrically-encrypted session key using a public key because public keys perform encryption, not decryption - only the corresponding private key can unwrap that value.

Encrypting a digital signature with a private key is the sender's signing action, not the receiver's - the receiver verifies by decrypting the signature hash with the sender's public key, not their own private key.