The social graph, at least in Bluesky's own collection[0], is made up of the sum of follow records in individual repositories on PDSes. Anyone can enumerate them.
These are summed up by Bluesky's app server (app view) and then used to fill out following lists in apps that connect to that server through its API.
A fact checking or web of trust tool could pull these records down and use it for exactly this purpose. It could even weight by who they repost, for example.
[0] A collection is basically an app's particular set of records stored in a user's PDS repository. Here's an example using the Bluesky CTO's follow records: https://pdsls.dev/at://did:plc:ragtjsm2j2vknwkz3zp4oxrd/app....
These are summed up by Bluesky's app server (app view) and then used to fill out following lists in apps that connect to that server through its API.
A fact checking or web of trust tool could pull these records down and use it for exactly this purpose. It could even weight by who they repost, for example.