There are several ways:

Central authorities: SSL, DNSSEC

TOFU: SSH, OTR etc

Web of trust: OpenPGP

Not sure, but I think Signal/WhatsApp a combination of central authority, TOFU and in-person 2 party verification, but no web of trust.