That solves integrity but not confidentiality. It does not protect against MITM.

It does protect against MITM. A man in the middle can pass the content along or they can refuse to do so but they can't forge a signature.

If confidentiality is required, well you already have a public key that you're using to verify content, then the content can say: "reach us at 196.7.3.45" and then you encrypt communications to that address with the same public key you use for validating content.

Or maybe they'll specify, in the content, that you should use a different key for that, but either way the chain of trust is preserved.

This would of course all be protocol level stuff, handled by the browser, not a human. They just have to maintain a list of keys they trust.