You verify identity over the now-encrypted channel, just like SSL should have done 30 years ago but refused to for doctrinal reasons. And in the (frequent) cases where you don't actually care about the other party's identity you just don't verify it at all.
Are we talking about with OTR? You're meant to verify fingerprints out of band as usual. Without, I guess you check if they've authenticated to nickserv if there are services. Or do your own checks or heuristics.
Even without registering my nick, I would expect a modern protocol to keep my pm communication private by default.