Its basically the same as a torrent or a public key. You have to first trust the source of the IPFS hash but if you trust the hash you can trust the content downloaded with it.

If for example NYT tweeted an IPFS hash, you could trust the content was from them.