exactly

and it's possible to create something of an identity-based system as well where you can publish an event with a set of structured claims

then anybody can respond to that bet with a set of structured assertions

boom now you have a web of trust

All claims are public all assertions are public

If you don't want somebody to know something about your public key don't publish it on the internet