As far as I know, the authenticity of communication in general is an unsolved problem. The web just reflects this. Just like with communication in general, if one wants authenticity, one has to add procedures for verifying authenticity on top of a system that doesn't have any built in.