The assumption was that a trusted third party exists. Since you trust it, by definition, you can contact it to confirm authenticity of the certificate.