According to my understanding, Digital Signature is a technology to use private key/public key to sign/verify data in order to ensure data authentication, integrity and non-repudiation. Sender signs the data with private key and send the signature with the original data to receiver, and receiver verify the signature to confirm the sender is trustworthy.
But I wonder how the receiver confirm whether the public key on his hand hasn't been changed?
I mean if it is possible that the public key has been intercepted and replaced with a fraudulent public key while transferring to the receiver, and finally receive a fraudulent message with a signature signed by a fraudulent private key? If there is a safe way to send a public key to receiver, why don't just send the message in the same way?
I tried to google for the answer but no luck, if you think this question is too simple you can just throw me the url or something, I am willing to study by myself.
Thanks in advance.