fph I have access to the signing keys! Well, sort of! And so do you!
The GrapheneOS build instructions include instructions for generating keys and signing builds. Over the summer I did a couple of builds and updates on a debug device as part of an experiment, using my signing keys.
So anybody who wishes they knew exactly who has the signing keys for GrapheneOS on their device can be 100% sure by building GrapheneOS themselves with their own keys (as long as they're kept out of the hands of visiting glowies). And people who don't yet know how to build it, or don't yet have access to a sufficiently powerful machine to build it, could choose builds done by anybody else.
Independent of who signs the builds there is a big question, which is who examines how many of the changes from upstream and/or from the GrapheneOS team. That part is hard! Clearly Google from time to time ships security flaws (I honestly think it's by accident), and empirically there aren't enough eyes on their commit stream to uncover all of them before they make it into builds signed by Google, builds signed by Samsung, and builds signed by the GrapheneOS project.
Hypothetically speaking, what if I knew how many people can sign GrapheneOS builds, and what if I knew their names, and what if I posted them? Likewise, what if, hypothetically speaking, I knew how many people can sign Google's Android builds, what if I knew their names, and what if I posted them? What would be different?