As identified in this related question, github signs commits made from their application with their GPG key
4AEE18F83AFDEB23. Online, I can see commits tagged as 'verified'. But when I attempt to verify them on my local, I am unable to:
$ git log --show-signature commit 1bd20e9f7ed0860dc1971957b61ea25aeea499a1 gpg: Signature made Tue 6 Feb 00:04:43 2018 AEDT gpg: using RSA key 4AEE18F83AFDEB23 gpg: Can't check signature: No public key Merge: c1218d5 0dde09c Author: Brendan Roy <email@example.com> Date: Tue Feb 6 00:04:43 2018 +1100 Merge pull request #1 from bmon/pullreq this is a test
1bd20e9 is a commit github made on my behalf. How can I verify the commit was made by github?