Docusign thinks an IP address is some kind of identity verification scheme (twitter.com)

Meh, the phrasing isn't great, but I think your title editorializing makes it sound worse than it is and an IP address of course is a useful datapoint that makes sense to record and potentially can be tied to a user.

GDPR states your IP is PII.