Verifying Bitcoin Core Integrity using PGP I downloaded the Bitcoin Core v0.20.0 from https://bitcoin.org/en/download

To verify, I first imported the signing key at https://bitcoin.org/laanwj-releases.asc and then ran command:

gpg --import laanwj-releases.asc

Then I downloaded the release signatures from https://bitcoin.org/bin/bitcoin-core-0.20.0/SHA256SUMS.asc and to verify I ran command:

gpg --verify SHA256SUMS.asc

Output was:

gpg:                using RSA key 90C8019E36C2E964
gpg: Good signature from "Wladimir J. van der Laan (Bitcoin Core binary release signing key) &lt;laanwj@gmail.com&gt;" [unknown]
gpg: WARNING: This key is not certified with a trusted signature!
gpg:          There is no indication that the signature belongs to the owner.
Primary key fingerprint: 01EA 5486 DE18 A882 D4C2  6845 90C8 019E 36C2 E964


Now, it says "Good signature" but the next two lines are WARNING:  This key is not certified with a trusted signature! There is no indication that the signature belongs to the owner.

What did I accomplish then, till this point?

I also tried running gpg --verify SHA256SUMS.asc bitcoin-0.20.0-win64-setup.exe but got gpg: not a detached signature as the output.

Not sure if I was able to verify it correctly or not. I was stupidly quick enough to actually run the installer after noticing "Good signature" in output and matching the Primary key fingerprint on the webpage and it matched. Please explain what's going on here.

Also how does this signing even verify the integrity of the downloaded file when the malicious actor can also modify the file at https://bitcoin.org/laanwj-releases.asc ?

Thank you!
GnuPG is telling you that the signature corresponds to that public key (your file has a valid signature and wasn't tampered with in transit), but that it doesn't know if that public key is trustworthy.

If you trust your friendly neighborhood CA, then do the following:

gpg --lsign-key 01EA5486DE18A882D4C2684590C8019E36C2E964


then enter your private key password to locally certify the key.

If you don't trust the CA (good on you for being suspicious), ask someone you know who you do trust for the key fingerprint. If that key fingerprint matches what you imported, then you can run that command. If it doesn't, then something is up.