How to locally verify signed commits by other people?

For analytics purposes, I'd like to run the following command and see which commits have been signed within a rather big repository:

git log --pretty="%h %G?"

As per Git docs, the %G? placeholder can return:

• G for a good (valid) signature
• B for a bad signature
• U for a good signature with unknown validity
• X for a good signature that has expired
• Y for a good signature made by an expired key
• R for a good signature made by a revoked key
• E if the signature cannot be checked (e.g. missing key)
• N for no signature

The expected result is to get a G status for every commit that is shown as Verified in GitHub. However, I am getting mostly E statuses.

git verify-commit commit-sha on a commit with E status outputs:

gpg: Signature made Wed  17 June 13:19:22 2020 EEST
gpg:                using RSA key C90455E28OCA2B4DAD319037E77216ECEABAF951
gpg: Can't check signature: No public key

I've done the following gpg setup:

git config --global gpg.program $(which gpg)
curl https://github.com/web-flow.gpg | gpg --import
gpg --edit-key noreply@github.com (where I put `trust` and gave 6 - ultimate)
gpg --lsign-key noreply@github.com

It seems that the only commits I get with git log having status G are the ones done via the UI of GitHub, as its key is successfully inserted in gpg.

Should I crawl and get all public keys for all contributors in the repo (by using e.g. their emails) and then insert them in gpg? Actually, what is the easiest way to see the signatures of ALL commits as they are shown in GitHub, locally?