I'm not sure how to answer this as it would require more context in regarding to what you consider a malicious actor and I would need more details regarding the

I'm not sure how to answer this as it would require more context in regarding to what you consider a malicious actor and I would need more details regarding the blockchain in question. But in regards to identity verification, you are correct that it would be through digital signatures controlled by private keys. In order for malicious actors to masquerade as legitimate ones, they would have to steal these private keys. That can both be easy and hard, but that is probably going to have a relatively strict correlation to how much is at stake.