Its not about “just having a signature”. Its about a web of trust. It only works if you verify if the key belongs to a creator that is actually a person.

Basically creators go to a convention and hand out their public key in person and have other creators sign their key. If you trust creator A is real and they signed the key of creator B, you can have some trust B is also real. And if your buddy went to the convention, met A and B, got their public keys and tells you they are real you can also trust they are real. The more steps/signatures you are away from a creator the less trustworthy they are and nothing really ensures a (human) creator doesn’t use AI secretly. If somebody is found to be a fraud everyone has to distrust their key.