Okay, thanks for pointing me in the right direction.

Now I Can answer by myself: 6 keys are whitelisted: https://github.com/bitcoin/bitcoin/blob/master/contrib/verify-commits/trusted-keys

There is a twitter discussion and people are asking exactly that: how many people are at the moment allowed to push directly on the master branch?

And how is this list controlled? What is necessary to add new people in the master-pushers and what is needed to remove someone?