You alone can decide whether to trust an npub. I think there is a great symbiosis between 'trusted domain names' (nip05) that can help bootstrap the trust in an npub.
We already 'trust' domain names and DNSSEC helps to ensure these domain names can't be spoofed