semisol on Nostr: Or, even simpler, it is similar to this: You want to talk to John Doe on Nostr. The ...

Or, even simpler, it is similar to this:

You want to talk to John Doe on Nostr. The problem is anyone can pretend to be John.

So, someone says "I will check your ID that you are John Doe, and I will give you a badge that I checked".

Your client implements a list of trusted checkers, and when you search for John Doe, only the verified npub appears. The others get a big scary warning "This may not be John Doe".

The client only trusts checkers that adhere to a given standard and have reputation, to prevent bad actors from being able to issue fake badges for anyone.

This is how HTTPS works but instead of npubs it is servers' public/private keypairs, and instead of people it is domain names, and badges are certificates