Yes, you would still have to trust FB to a degree , especially in the initial phase and they would still be serving the code that did all of the crypto so you h

Yes, you would still have to trust FB to a degree , especially in the initial phase and they would still be serving the code that did all of the crypto so you have issues there. Once the trust was established though, especially with OTR it would be more difficult for them to later start abusing it. But it's still an improvement on FB having everything on their server under their complete control, if they starting messing with keys people would notice. There could be a problem with people just signing any old key, but really you just need to verify that the person is who they say they are. I think that works 90% of the time on FB as it is, it's unlikely you'd get away with being an imposter.