I think this is naive, is it just kicks the can. How do you trust that the signer is human?

True, I can only know that the owner of the private key signed but not how the document was created. But I suppose there is some trust involved that a person I know who signs doesn't sign some AI generated stuff. To establish the initial link, I suppose we need something more mainstream/scalable than the old key signing parties I remember from CCC etc.

But at least for friends and family it should be possible to create some flow where every member has a key-combo and you trust them to only sign stuff they wrote etc. and have local mini-keysign parties.