i think it's aimed at solving the problem of someone impersonating whatsapp server and responding with corrupted public keys ( but then this person could also impersonate the key repository server ?)
it doesn't however protect users against whatsapp cooperating with states to introduce spying devices / intermediate in your conversation. Does it ?
While we do maintain the directory, we are held to an honest standard by our audit logs. Should any auditor find invalid records, they can publicly hold us accountable.
Either whatsapp knows the phone is hacking the account to a new number / device, in which case it should simply disable it, or it doesn't and then it will treat it exactly like a normal one.
1. Acquired my Canadian number.
2. Identified it as "my" account, and downloaded a picture of my social media to use as a Whatsapp display picture.
3. Somehow, identified my cousin as a potential target. Not sure how they did it.
4. Located where roughly my cousin lived. Perhaps via social media check-ins or some other way.
5. Asked my cousin to meet in a park not too far from his house, because I was in trouble and needed money.
Thankfully, my cousin did not fall for the scam and contacted me via other means to verify.