Messaging new contacts should have a TOFU (Trust on First Use) check just like Zapstore has, using web of trust, NIP-05, and other trust signals. Of course that can only be built on nostr.