I think WhatsApp has the big scary warning when keys change disabled by default. You can enable it for yourself but it's buried in the settings.
Maybe it's something else I'm missing, which is why it would be good for Moxie or Whatsapp to clear up this puzzling choice.
Also I hope both the Whatsapp and Signal teams think of ways to encourage security code authentication through better UI. Viber, for instance, has taken an interesting approach to encouraging easier authentication. It probably still doesn't go far enough to make it easy enough for just about anyone to want to authenticate their contacts, but I'd like to see more of this sort of UI experimentation:
https://support.viber.com/customer/portal/articles/2017401-v...
Spamming users with warnings that 99.9999% of the time will not be understandable let alone actionable is a quick way to get another SSL warning dialog scenario.
I really hope it's not a new set of keys every time Whatsapp updates...
You could argue (and I have done) that a key change event should be surfaced in the UI as "Your contact has switched to a new $MODEL_NAME phone" so if it occurs in the middle of a conversation or you happen to know they really haven't upgraded, it can lead people to tap it and learn more. An alert like "Contact key has changed" would be meaningless. But it's also the case that notifications that seem useless to people rapidly get phased out, and unfortunately any notification that boils down to "you MIGHT be being attacked by your own government but PROBABLY your friend just dropped their phone" is a non starter.
Moxie did not make Whatsapp. He made the protcol originally designed for Signal/TextSecure that Whatsapp uses. It's a little extreme to blame him for what is basically a UX/GUI decision on an app that just uses his protocol.