The trusted authority is the group "Bitcoin Core developers" in general. It doesn't matter that there are multiple people in that group who would have to sign off on an alert, they are a trusted authority as they are part of the group "Bitcoin Core developers". Because those developers are part of the same group, they, as an entity, may decide to publish an alert for something which users may not want. Users have to trust that the group as a whole does not partake in any malicious behavior.