Signal exchanges keys in the QR code. It's not that you generate a random new key and people just start encrypting for that key without verification. (I don't

Signal exchanges keys in the QR code. It's not that you generate a random new key and people just start encrypting for that key without verification. (I don't use WhatsApp so I don't know if they do the same.)