But wouldn‘t the public key need to be somewhere to? At some point down the line you will probably have to trust some server.