But according to the diagram: http://www.wired.com/wp-content/uploads/2016/04/Whatsapp_Enc...
... A's message is encrypted with Whatsapp's public key, which means that Whatsapp's private key can (and has to) decrypt it on the server side to encrypt it in turn with B's public key.
If the diagram is truthful, the claims the article makes are incorrect.
With PKI the ability of the user to verify that they received and used the correct public key is critical and while I have to admit that I haven't read that much about WhatsApp's E2EE setup I haven't seen anything that shows how this issue can be mitigated in a way that would be useful for most users.
How foolproof is the verification system, how susceptible is it to downgrade attacks (while E2EE isn't not universally deployed) is there are 3d party verification of signatures, is there a community trust signing, can whats app disable E2EE in it's application without a noticeable UX change to either party, how does this work with multi user messages, how does this work with multiple devices, how does this work with historic messages that were encrypted using different keys etc.
I would say that there are sufficient "unknowns" at this point to take the security of this entire solution with some skepticism especially if you remotely planning to use this for anything that could put your life at any risk.
The whitepaper (https://www.whatsapp.com/security/WhatsApp-Security-Whitepap...) goes into more detail.
That said, they could push out an update that changes the UI to disable E2EE without notifying the user, and that would be difficult to notice since the app is closed source. For this reason Signal is more secure, despite using the exact same protocol.
If WhatsApp decides to act malicious, yes, this method would make it very easy for them.
After reading the other sources of information, it's clear it is a secure protocol. More so when designed by the Snowden-approved Open Whisper Systems team.