In PGP the default is that a key is untrusted until you perform some explicit verification step
I wonder what that verification step will look like in a WoT on Nostr