Using nested signatures to trust public key of inner signatures I have a scenario where entity $A$ has an unauthentic copy of the public key $P_B$ of $B$ and an authentic copy of $P_C$ of $C$, trusted by both $A$ and $B$. 

Now $A$ wants to establish trust in $P_B$.

Steps:


$B$ writes a message, signs it and sends it to $C$ : $$B \rightarrow C: M \| S_B(M)$$
$C$ is an intermediary entity and forwards the message to $A$ : $$C \rightarrow A : M \| S_B(M) \| S_C(M \| S_B(M))$$
$A$ then validates $S_C(S_B(M))$ and $S_B(M)$ successfully


Can $A$ now trust the authenticity of $P_B$ because the signature $S_B(M)$ was received in an authentic manner?

The practical example is DKIM in E-Mail infrastructure:


sender may sign her outgoing message (e.g. using PGP);
does not attach public key to not annoy non-PGP enabled receivers;
the message including the signature gets signed by the providers DKIM key;
the receiver gets a copy of the sender PK and wants to establish some trust beyond TOFU.
I think this depends heavily on the expectations and trust that A has with respect to C.  $A$ should be safe to now view $P_B$ as authentic provided that $A$ trusts that:


$C$ will only sign $B$'s message if it could successfully verify $S_B(M)$
$C$ would only use $P_B$ if it had previously obtained and verified the authenticity of $P_B$
$C$'s requirements for verifying the authenticity of $P_B$ are at least as strict as $A$'s


Note that this is essentially the same as with certificate authorities, where $P_x$ are X.509 certificates (e.g. $P_C$ is the root certificate for a CA, $C$).  $B$ can't expect to provide $P_B$ to everyone it expects to communicate with so instead it establishes trust with $C$ which then signs $P_B$.  When $A$ receives data from $B$, it would first receive $P_B || S_C(P_B)$ then $M || S_B(M)$.  $A$ then decides to trust $P_B$ on the grounds that $C$ would not have signed $P_B$ without first establishing it's authenticity. $A$ then, in turn, trusts that $M$, in fact, originated from $B$.

However, it's important to note the $A$ having authenticated $P_C$ is not sufficient.  Messages signed with $S_C$ may, in fact, be coming from $C$ but that does not mean that $C$ is fully trustworthy.  For $A$ to trust $C$'s trust of $P_B$, $A$ must also trust that $C$ is sufficiently cautious about establishing the authenticity of $P_B$.  Just as it would be extremely concerning if a trusted certificate authority were to start signing any certificate sent their way, $A$'s confidence in the authenticity of $M$ and $P_B$ must not be greater than $A$'s confidence in $C$'s process of establishing trust.

Similarly, if $C$ viewed its job simply as marking that it received and relayed the message, blindly signing the entire payload it received, $A$ would be mistakenly assuming an assurance not actually provided by $C$.

Long story short: $A$ can only trust $P_B$ if it trusts that $C$ is, and is sufficiently capable of, guaranteeing the authenticity of $P_B$.