Well you start with someone you know personally or through domain control (NIP-5) and then build from there.

It could be build as a identifier that shows that a pubkey is trusted by people you marked as “trusted”.