In order to verify the signature, you'd have to get their public key. Since that's where this all started, we're just in a loop of untrustworthy ways to get so

In order to verify the signature, you'd have to get their public key. Since that's where this all started, we're just in a loop of untrustworthy ways to get someone's public key.