It is almost 30 years now since Ken Thompson presented his widely known ACM Turing Award Lecture "Reflections on Trusting Trust". What is the current status of practice and research on trust management?
Biggest problem in trust management is that it involves people who don't act like machines.
Public-Key Infrastructures can be seen as a big exercise in trust management. The two main deployed solutions, X.509 and OpenPGP, implement two strategies which can be described as "let's add all the needed features that application won't bother to implement properly, or at all" and "let's do nothing and pray for the best", respectively. By right they should both fail in horrible (but spectacular) ways. In practice, there are not so many issues because people are still basically honest.
But really, security does not make dollars; you will never be able to say that stricter controls resulted in 10% sales increase. Therefore, trust management will be underbudgeted, badly done, and rely on luck. That is the biggest unsolved issue: how could we make trust management, and security in general, be recognized as important enough to, generally, warrant a bit of care ?
(The one known way to make trust management safe is to make it known that offenders will be shot. This is what they do in war-time armies.)