You can read more about how this is done in the article, but essentially, it involves social graph distance plus some validations, such as certain events and indicators that signal common best practices in Nostr. It's not perfect; we are still experimenting. The idea is to have a way to determine the most trustworthy profile from a given perspective (source pubkey) to deal with impersonators.