You're right! Those are all excellent solutions to basic discovery and management problems. With that said, is it perhaps worth considering that this could be

You're right! Those are all excellent solutions to basic discovery and management problems. With that said, is it perhaps worth considering that this could be a scenario where fully automating something is in fact not sufficient? As you so wisely and correctly point to, Apple has made key management work. Yet most Apple users probably wouldn't notice, or know what it meant, if they were told that whoever they were texting had a new key. From experience this is already true of messaging systems like Signal and Wire. Making available documentation that clearly and simply explains the matter and what the user could or should do has, historically, not reliably been a great way of resolving this issue. It might be worth considering that there could be more at hand that an onerous task that just needs a smidge of standardization and a pinch of automation - though to be clear you are completely right that both are needed and would be very beneficial. Real security generally needs to involve users understanding and weighing risks. I've yet to see any method to automate that well, though I would love to be shown how I am badly mistaken.