Ideally it’d be linked to public key on a DNS txt record or similar, and trustworthy clients (including social media apps) show the domain linked to the photo.