I downloaded the Bitcoin Core v0.20.0 from https://bitcoin.org/en/download
To verify, I first imported the signing key at https://bitcoin.org/laanwj-releases.asc and then ran command:
gpg --import laanwj-releases.asc
Then I downloaded the release signatures from https://bitcoin.org/bin/bitcoin-core-0.20.0/SHA256SUMS.asc and to verify I ran command:
gpg --verify SHA256SUMS.asc
gpg: using RSA key 90C8019E36C2E964 gpg: Good signature from "Wladimir J. van der Laan (Bitcoin Core binary release signing key) <firstname.lastname@example.org>" [unknown] gpg: WARNING: This key is not certified with a trusted signature! gpg: There is no indication that the signature belongs to the owner. Primary key fingerprint: 01EA 5486 DE18 A882 D4C2 6845 90C8 019E 36C2 E964
Now, it says "Good signature" but the next two lines are
WARNING: This key is not certified with a trusted signature! There is no indication that the signature belongs to the owner.
What did I accomplish then, till this point?
I also tried running
gpg --verify SHA256SUMS.asc bitcoin-0.20.0-win64-setup.exe but got
gpg: not a detached signature as the output.
Not sure if I was able to verify it correctly or not. I was stupidly quick enough to actually run the installer after noticing "Good signature" in output and matching the Primary key fingerprint on the webpage and it matched. Please explain what's going on here.
Also how does this signing even verify the integrity of the downloaded file when the malicious actor can also modify the file at https://bitcoin.org/laanwj-releases.asc ?