There are several ways:<p>Central authorities: SSL, DNSSEC<p>TOFU: SSH, OTR etc<p>Web of trust: OpenPGP<p>Not sure, but I think Signal&#x2F;WhatsApp a combination of central authority, TOFU and in-person 2 party verification, but no web of trust.