Lets say Bob wishes to communicate with Alice.

Alice's public key is useless to Bob unless he can prove that the public key came from Alice. To do this, Bob and Alice can establish a secure channel to exchange Alice's the public key, but this same channel can equally be used to exchange a symmetric pre-shared key, so there is no security advantage to using a public key here.

Alternatively, Bob and Alice can both trust a third party Carol, who will verify Alice's public key as belonging to Alice, and then give that public key to Bob, who trusts Carol.

But this doesn't solve the problem. For both Bob and Alice to communicate with Carol, they need Carol's public key and the ability to prove that it belongs to Carol. To achieve this, they both need a secure channel with Carol, which they could then just use to exchange a symmetric pre-shared key between each other, and communicate that way.

In both cases, they would need to trust Carol to not abuse their trust and eavesdrop on the information. Either by swapping out public keys and intercepting the information, or by just using her knowledge of the PSKs to decrypt it.

There don't seem to be any security advantages here. And the security model itself seems to be identical. Is there something I'm missing here, or are the differences purely in terms of scalability?

Lets say Bob wishes to communicate with Alice.

Alice's public key is useless to Bob unless he can prove that the public key came from Alice. To do this, Bob and Alice can establish a secure channel to exchange Alice's the public key, but this same channel can equally be used to exchange a symmetric pre-shared key, so this is effectively identical.

Alternatively, Bob and Alice can both trust a third party Carol, who will verify Alice's public key as belonging to Alice, and then give that public key to Bob, who trusts Carol.

But this doesn't solve the problem. For both Bob and Alice to communicate with Carol, they need Carol's public key and the ability to prove that it belongs to Carol. To achieve this, they both need a secure channel with Carol, which they could then just use to exchange a symmetric pre-shared key between each other, and communicate that way.

In both cases, they would need to trust Carol to not abuse their trust and eavesdrop on the information. Either by swapping out public keys and intercepting the information, or by just using her knowledge of the PSKs to decrypt it.

There don't seem to be any security advantages here. And the security model itself seems to be identical. Is there something I'm missing here, or are the differences purely in terms of scalability?