Something like PGP without automatic trust of new connections may work, as if cross with Facebook's friend system. "This user claims to be Jimmy Jimson (image

Something like PGP without automatic trust of new connections may work, as if cross with Facebook's friend system. "This user claims to be Jimmy Jimson (image of fingerprint). Trusted by 19 people you directly trust, and by 250 people they trust. [add] [ignore]". Is this feasible? I'd rather attackers social engineer people rather than subvert the technical, non-human aspects. And like Facebook, if you see two of the same person on your Trusted list, you know one of the accounts is probably not under their control.