For folks with larger followings, they can let people know on their podcasts via RSS. For others we can tell friends via Signal, SimpleX, GitHub and etc. perhaps some others?

And yup, an attacker could change the profile to anyone. They could impersonate someone else and with some credible WoT.