If you're being contacted by an anonymous person you have no idea who they are in the first place. Since you don't know an anonymous person's identity, how are you supposed to fetch and validate their public key?