How does one really verify someone’s public key in this situation? E.g. a fake account would presumably be able to generate a fake website of themselves that lo

How does one really verify someone’s public key in this situation? E.g. a fake account would presumably be able to generate a fake website of themselves that looks at least semi-legit, and use it to post their pubkey. What would give us confidence the key comes from a legit person?