NIP-05 with domain known to be owned by the real person seems to be the best we currently have.

Maybe some web of trust layer could be added - PGP sign something with known key?

Then maybe clients could block automatically anything that pretends to be somebody verified / trusted they are already following.