[Aachen]

Signal exchanges keys in the QR code. It's not that you generate a random new key and people just start encrypting for that key without verification.

(I don't use WhatsApp so I don't know if they do the same.)