People will just blindly sign events. Until they get compromised and start paying attention. But a malicious app would also likely be pointed out pretty quickly. Web of trust helps here too. Just observations.