You're right. So when you get a notification of a key change (for malicious or other reasons) it is up to you to verify that the user did indeed have a key chan

You're right. So when you get a notification of a key change (for malicious or other reasons) it is up to you to verify that the user did indeed have a key change — preferably out of band, or at least over another medium.