I read about trustlines here.
But in implementation, how do you make trust decisions, and what can go wrong if you're wrong?
In practice: how can you measure whether a counterparty is someone who should be in your trustline? Do you authenticate them on-chain or through some off-chain method?
Mechanically, what combination of endpoints would you use to measure aggregate trustworthiness in all transactions on the network?
You can not determine trustworthiness in an automated way, you have to personally decide if you trust a counterparty. Worst thing to happen is, that you trust a scammer, insolvent or (if they lose the backed anchored asset for any reason) incompetent company and the tokens you buy/hold on that trustline are actually worth nothing.
Your trust lines are defined by an asset code and the issuers accountId. You should look up the issuers home_domain (horizon api) and then look up the issuers stellar.toml (https://[home_domain]/.well-known/stellar.toml) to verify that the account you are about to create a trustline with is indeed listed and not a fake account that simply points to a known service. Then you have to decide on your own if you find your counterpart trustworthy (Do you know them personally? Is it a registered company? Where are they located? Are they insured?).
You could analyze trade and transaction volumes but since those could also be generated at a relative low cost I would not trust that metric in the first place. Use an explorer like stellar.expert to get a first impression about number of asset holders, number of recent trades and payments. Btw: stellar.expert also shows a verified icon if the asset is correctly listed in the according stellar.toml.
Otherwise I'm not aware of any handy api endpoints to gather this kind of relevant data based on assets but you could get your own stellar-horizon server and look up the history_operations, history_trades... database tables.
