Let's assume I am able to confirm a certain message's signature with a public key that seems to be from Alice. So I should be sure that the sender of that message is really Alice. But what if I have a public key where I think it is from Alice but actually is not and it still can confirms the signature of the message I got. So I am thinking it is from Alice since I used a key that is published as Alice's Public Key just from somebody else and that can confirm a message's signature I got where I think it is from Alice.
How can I be sure that both the message and the public key are really from the person they are named to be from?
There might be some weird thinking mistake I did here so I'd be happy to get enlightened.
Tried to visualize it.
Thanks in advance.