de0u fph I have access to the signing keys! Well, sort of! And so do you!
The GrapheneOS build instructions include instructions for generating keys and signing builds. Over the summer I did a couple of builds and updates on a debug device as part of an experiment, using my signing keys.
That does not really answer our question. If I understand correctly, the Graphene OS build we all have installed (apart from the very small minority that builds and updates the system themselves) is signed with keys from the Graphene OS team. In order to continue receiving OTA updates, those updates need to be signed with the same key, or the bootloader complains.
If only one person has access to this signing key, and that person goes rogue, then we all need to reinstall the system from scratch in order to continue receiving updates. This is precisely what happened to Calyx OS, if I understand correctly.
Also, and more importantly, if someone who has access to that key goes rogue, they are in a position to push a malicious update. Essentially, they have root on our systems.
So I believe that "who has the Graphene OS signing key" is an important question. And I mean the key that signs the official install, not the key for a custom build as in your answer.