Web of Trust was a big part of that toehold for identity. You want some sort of attestation of "this person is who they say they are" and Web of Trust is no wor

Web of Trust was a big part of that toehold for identity. You want some sort of attestation of "this person is who they say they are" and Web of Trust is no worse than paying an Authority (a Certificate Authority) to say that. It's just harder. (That's the trade-off axis there: harder versus more expensive.) Keybase even almost proved that you could automate a lot more of Web of Trust and make the UX overall much easier. (The LINK tag based approach to attestation in the article here is almost directly a predecessor to that.) Identity without any attestation is hard to impossible to work with. Web of Trust wasn't the "best" solution to that, but PGP identity was built on/for Web of Trust. Web of Trust was necessary to PGP and was arguably a big part of why PGP failed to be people's preferred identity tech, because Web of Trust was too hard to get right and not enough people trusted Web of Trust.