&gt; If WhatsApp is trustworthy and secure, then the QR code might be a hash of the public key, but to be completely frank, it could be anything.<p>The problem being solved here is validating that another Whatsapp user&#x27;s key belongs to a flesh-and-blood person you know. We&#x27;re taking it on faith at this point that Whatsapp&#x27;s application is trustworthy. If it&#x27;s not, validating keys is useless -- the app could upload all your chat transcripts in the background for all we know.