It can; Apple's approach is to distribute lists of public keys instead of single ones. The seem to have the same threat profile: Apple can be compelled to silently add a public key to the keybag; Telegram can probably be compelled to silently replace a public key with an MITMed version.