gpg checks the signature against all the public keys you have.
If you have two private keys, you should also have the corresponding public keys. So,
gpg will look through all the public keys you have, including your friend's keys, and figure out who signed the file.
If the file is signed by me and you don't have my public key, then
gpg can't verify my signature, until you download my public key from a public key repository like https://pgp.mit.edu/
More detailed explanation below is from https://security.stackexchange.com/questions/82490/when-signing-email-with-gpg-how-does-verification-by-the-receiver-work
There is a unique association between public and private key. That is,
if the sender uses a certain private key to sign a message and you verify the signature using the corresponding public, then the
signature verification will succeed only if the message has not been
The verification procedure and nature of the association between
public and private varies with the cryptosystem you are considering
(RSA, DSA, etc.), but the statement above holds true for any
What really matters is that the sender is the only one that can
produce a valid signature because he/she is the only one who knows the
private, but anyone knows the public, so anyone can verify the
Upon signing, GPG adds a token to the text message which can be used
to verify that the message has not been altered in transit: that's the
signature. You don't need GPG to read the message because the text
itself is not encrypted, there is only an extra token, which could be
either a radix64-encoded blob at the end of the message or a text
attachment with a similar structure.
GPG does not directly sign the message, it signs a cryptographic hash
(SHA-1 or SHA-2 usually) of it. What happens upon verification is that
the signature is verified using the public key of the sender to make
sure the received hash was actually originated by the sender. If the
hash calculated by the sender is considered authentic, it is compared
with the hash calculated by the recipient. If both phases succeed,
then the message is correctly signed.
Hope this helps