That's the right question, and what my work a quarter century ago on "attack resistant trust metrics" attempted to answer. That's written up in a bunch of places, but I think probably the best starting point is my "lessons from Advogato"[1] talk in 2007.