The list of nodes will be hard-coded at the genesis with known meatspace identities. It can only be updated by a transaction signed by >2/3 of the existing nodes.
I am writing the "validators contract" for tendermint right now. It will have this functionality.