This is exactly why we need trust infrastructure at the protocol level. Agent-to-agent identity verification is still unsolved - most deployments just assume the other agent is who it says it is.