The basic idea of the web of trust, as used in PGP to send messages, is peer validation:
Alice knows Bob, Bob knows Cindy, but Alice does not know Cindy. Cindy wants to send Alice something privately, but first needs to be "introduced" to Alice.
Cindy begins by first asking Alice for her public-key certificate. Alice sends it; it's public information, so she can broadcast it to the world. Included on this one certificate would be a number of digital signatures, each from a person Alice knows, including Bob, who is vouching for the accuracy of this certificate. Each signature is unique to the combination of the certificate and the signer, and the creation of a signature requires a private key known only to that signer. Once created, anyone who knows the public key matching the signer's private key can use that key to verify that the signature matches both the message and the signer (or that it doesn't).
As such, the evil Eve cannot hope to alter the message in such a way that the signature(s) would still match, nor can she change the signatures themselves, without having compromised the private keys of all signers. The worst she can do, given that someone else already knows and is vouching for Alice's identity, is corrupt the certificate causing Cindy to reject it, preventing the intended communication.
Alternately, Cindy could ask all her friends if they know Alice, and any that do, including Bob, can each forward Cindy a copy of Alice's certificate with only their signature on it. This reduces the number of signatures that have to be included on a single certificate to provide a good chance for Cindy to recognize one; since Cindy's asking her own friends, who would only respond if they did indeed know Alice, Cindy only receives signatures from people she knows and ostensibly trusts. But, it could cause a flood of data to be sent to Cindy if Cindy and Alice have a lot of mutual friends.
In either case, Cindy scans these signatures for signers that she knows. She find's Bob's name, validates his signature of this certificate, and now knows that Bob thinks this is the real certificate for the real Alice. Cindy now has the choice to trust Bob implicitly, and so trust Alice's certificate herself on his word alone, or to partially trust Bob, and look for other people she knows who have signed Alice's certificate. If she finds enough people she partially trusts, or at least one person she implicitly trusts, she can trust Alice's certificate by extension. This is known as the "trusted introduction" and is central to the web of trust.
Once Cindy decides to trust the certificate, she uses its public key to encrypt the key to a symmetrically encrypted message that has also been signed by Cindy with her own certificate. She then sends it to Alice. Alice doesn't know Cindy, and so repeats a similar process that Cindy did to obtain, validate and decide to trust Cindy's public-key certificate (which she does, because Bob has signed Cindy's certificate and Alice trusts Bob implicitly). She uses her own private key to decrypt the message key, then uses the message key to decrypt the message, and finally uses Cindy's public key to validate the message's signature.
Now, that's with three people who are already partially "entangled" in the web and so can trust each other based on peer recommendation. For two people with no mutual trusted friends, such as when a web is just starting or when a new person who's never used PGP before tries to join, this automatic peer recommendation simply won't work; there are no peer recommendations to speak of (there may not even be peers). To spin the first few threads of this web properly, the people wishing to form it must exchange certificate files with each other inside an environment that is inherently trusted (known as a "key signing party"). Otherwise the evil Eve can intercept the certificates being exchanged, replace them with forged certificates, and she becomes a "man in the middle".
The oldest, simplest way to avoid this is simply to meet in person and physically exchange certificate files with each other. Other possibilities, such as secure drop-boxes, exist, but all Eve needs is one second of unrestricted, undetected access to the physical storage of the key to screw it all up.
