Does any nation-state CA (certificate authority) have a public API to verify digital signatures?
No, the CAs do not verify digital signatures, the relying-parties (the recipients) do the verification by themselves, using their own software applications. Eg, use Adobe Reader (free version) to verify digitally signed PDFs.
However, the CA's do publish a public CRL (Certificate Revocation List). That file can be viewed as an API that aids in the verification process. It does not do the verification process per se.
And some CA's provide access for Online Certificate Status Protocol (OCSP) requests. OCSP is a newer technique for determining if a certificate has been revoked or not. Eg Verisign. Like CRL files, OCSP helps with the verification process but is not the same as verifying a signature.
And if none of the 200+ nation-states verify digital signatures, how does Bob verify that Alice is really Alice ?
Bob opens the digitally signed document or data by using the appropriate software application. To verify a digital signature, Bob's app goes through a number of steps. One of the steps is to re-create the trust chain between a certificate that Bob already trusts and Alice's certificate which Bob does not yet trust.
If Bob's software is able to re-create the trust chain, then doing so gives Bob some level of assurance that Alice is who she says she is.
How high is the level of trust? It depends on the polices and procedures of the root CA and the intermediate CA's on the trust chain. It also depends on Alice properly safeguarding her digital signature device.
If you're into "movie plots" then it is always possible (but not likely) for someone to forge someone else's signature no matter what technology was used.
In the real world, signatures denote trust and relying parties determine what level of trust they need to accept a given signature on a given document.