As others have mentioned, a trusted 3rd party signs the correct key so your browser can check the key itself.

However, it should also be noted that your browser must have a list of trusted 3rd parties and their certificates used for signing in order to perform this check. It's entirely possible to modify this list yourself. Some examples include:

• executing your own MITM style "*attack" in order to intercept and analyze local https traffic
• corporate network inspection and monitoring, where a gateway does the above for all devices on the network which have a CA cert pre-installed through some policy

So while it's possible for trusted 3rd parties to issue valid certificates to bad actors, it's also possible to add anyone (you, your employer, or some bad actors) to the trusted parties list.