&gt; What else would you validate? A number? Whatsapp can just show you the wrong number.<p>Good. You appear to understand the problem now.<p>I already alluded to the solution here:<p>&gt; If I had access to my own public and private key, I (or someone I know) could conceivably verify that I&#x27;m using it by decrypting my messages using another device (e.g. using wireshark).<p>and here:<p>&gt; That&#x27;s why providing the keys (or better: being able to supply my own) is essential.<p>See, if I have the keypair, then for WhatsApp to subvert my conversation it needs to send the private key to itself -- something it can only do when it&#x27;s not looking.<p>This means it would need to let me download the keys before it does any networking. If it absolutely must network before letting me have the keys, then it can allow me to install my own (new) keys. Then, WhatsApp <i>doesn&#x27;t know</i> when I&#x27;m not looking.<p>If WhatsApp made it possible to catch them being dishonest, then it only takes one person to catch them and their name becomes mud.<p>Of course, the mere possibility that moxie could be compromised or even make a mistake is clearly too big a leap for HN these days...