> how can you verify that a user with a certain public is who they say they are instead of an impostor

This sounds awfully much like a cryptography problem to me!