Proof possession of private key in libsodium
If you are going to public the same message with a signature multiple times, it is vulnerable to a replay attack. This is where another party basically copies your message and signature and can re-publish it at any time, implying that they own the key. To counter this, add a small piece of information to the message before signing, say a counter or random number that is unique per signature published.

As for trusting signing keys, a trusted party ie a Certificate Authority or a PKI must be used so that any data received from them is trusted. So when Alice publishes a message and a signature, the CA tells people Alice's static public key, this is trusted, and then everyone can safely verify the fact that Alice does indeed own the private key she claims to own.