In PGP the default is that a key is untrusted until you perform some explicit verification step
Which is why I still like PGP, despite its clunkiness.
🐸1💯1