&gt; Against what, though? The key that Whatsapp asserts is valid for the other user?<p>No, against the other person sitting at the table with you via QR code scanning.<p>Or their voice speaking the public key via another channel.<p>&gt; just what the app presents as a signature or QR code. Open to correction.<p>What&#x27;s wrong with the QR code? That QR code is a hash of the public key and exactly what you need for this identity verification purpose.<p>If the pubkey changes after you&#x27;ve scanned it, you know you&#x27;ve got to verify that person again before sharing anything private over that channel.