You're assuming that a global system must be trustless. This is not really a requirement. Heck, in most cases its not even desirable.