First, word of mouth. Second (better solution) a non-profit certification authority something like Underwriters Laboratories that monitors ad networks for malware, and gives its seal of approval for good ones. WaPo could then advertise that seal on their website.

Then of course when an ad network screws up you have a certificate revocation problem, but that's another story.