Yeah that's confusingly said, the WoT provider can of course add any pubkey he wants without user action. Or the user somehow initiates this, for example with payment.