Madison,
Great question, the true identity of Issuer is critical because all of a credential’s power comes directly from the authority of that issuer. This points to the need for a more proactive public registry (or registries) of public keys, along with some kind of visual indicator that proactively checks against these known keys. Until then, the good news is that the community can fairly easily check against an Issuer’s known signing keys. Those handles never really existed before. So, all the materials are there to build an even more convenient verification check for issuer/reputation going forward. One step at a time!