Yup.
A npub on its own is just a npub. That’s why I believe NIP-05 is a good start, though not the eventual solution. Reputation is a function of context: over time, the events that a npub emits, over relationships: the ‘web’ in which the npub is judged to be a good part.
Not sure we have the solution yet, but what is encouraging is that, with #nostr, we have a different starting point than other so-called solutions that have a permissioned starting point.