"If I give you my public key, say I post it on my web site, how can you be sure that it's really my key? Maybe my site has been hacked and I don't even know it. Or maybe someone tampers with the site content between the time it leaves my server and arrives at your browser (though TLS is supposed to address that).

We could get on a phone call and I you could read the key back to me. The problem with this approach is that keys are long. A 4096-bit RSA key, for example, encoded in hexadecimal, is 1024 characters long."

If trust the "phone" and phone numbers but not the "internet" and IP numbers, then why not just use modems to transfer the public key.

Is the assumption that it would be impossible for both the person's website and his phone to be simultaneously compromised.