That's no different from a real picture/painting though is it?

Regardless, if you get the current verifiable statements signed by a trusted entity every now and then, you should be able to verify the trust chain, no?

Before the old keys expires you get someone to verify and sign with a new key, rinse repeat?