The most famous attempt at a web of trust was PGP, but it just attempted to bind a public key to a name. That's too generic. Only privacy nerds are actually going to have a key signing party if that's all they get out of it.

I think that it'll go better if the we're attesting about common interests. Like, go to the event because you're enthusiastic about games, end up with some public keys as a side effect.

It'll be hard if you're the only person you know with a particular interest and it's impractical to travel to wherever people with that interest gather. Then you'll have to take a gamble on some internet handle you've never met. But really that's just falling back to the dubiously trustworthy web we currently have.

For any of this to work we have to already be gossiping metadata about each other's content. "I think this key was compromised on Nov 1, 2026" is exactly that kind of metadata. That sort of thing rarely happened in PGP because key revocation was necessarily a side channel that you were often ignoring. But if the only way to avoid being inundated by slop is to assemble the page from the gossip of trusted peers, then the untrusted nature of the recently compromised key is gonna show up right next to its dubiously trustworthy signatures, and your browser can then interpret it without you having to do any sleuthing on your own.

How hard are you really gonna work to compromise a key that you can only use for a few days? I mean, the going rate for placing an ad on a page is like, fractions of a cent per view. Maybe it'll be more valuable in a post-ad world, but I have a hard time imagining that getting your content in front of some eyeballs for a day or two will ever be valuable enough to be worth hitting somebody with a wrench over. What you have to gain by doing so just isn't valuable enough to be worth the risk.