I don't understand why do you want to sign that UK person's key in the first place. You can't verify who they are and only communicate online. Ok - that sounds to me like you shouldn't announce "I trust this is a real name/email" in that case. You can trust it privately and still use the key anyway.

But nobody is forcing you to sign the key, or even then to publish that information on the internet. As you say - how do you know they're that person?

(I'm ignoring the part of - should we even care that the identity matches. You communicate with the (person, key) tuple - you can still trust that tuple and not care if the name matches government documents)

A bank is a slightly different case. Your key for communication with the bank is (usually) more interesting than the key you use for emails. The bank also has both interest in protecting communication and means to do something better than key signing. Some banks will actually issue you a smartcard (or some equivalent) from which you can't export the private key at all - it may even be a gpg key. The point is - that's a much better protection on average, because an average bank customer has no idea about gpg, but will likely not give the smartcard away to someone random. Finally, few people have passports and you shouldn't be required to have a passport to have a bank account.