You're supposed to meet up with that contact and verify the new key. If even 0.1% of users did that, it would be 2 million verifications. And yet nobody has

You're supposed to meet up with that contact and verify the new key. If even 0.1% of users did that, it would be 2 million verifications. And yet nobody has ever announced they have found a non-matching key.