[kalsk]

How susceptible is this Signal Protocol to a man-in-the-middle attack? Because if Facebook is going to be the man in the middle, then this feature is pointless.

[xnull2guest]

Here Facebook isn't even a man-in-the-middle. They are a 'man-on-the-box'. They get to generate the nonces, keys, etc.

It's pointless to add encryption if Facebook is your root of trust.