I have run:
sudo su -s /bin/bash -c "gpg --home /var/www/.gnupg --import /var/www/passbolt/config/gpg/serverkey_private.asc" www-data
… as suggested by the healthcheck. This produced:
gpg: WARNING: unsafe permissions on homedir '/var/www/.gnupg'
gpg: key xxx: "FirstName <xx@xx.com> not changed
gpg: key xxx: secret key imported
gpg: Total number processed: 1
gpg: unchanged: 1
gpg: secret keys read: 1
gpg: secret keys unchanged: 1