They can also tell your client it has the correct key. Yours and the other clients are all talking to their mitm in this scenario. There's fundamentally no way to solve this without users verifying keys out-of-band.
No they can't. Key transparency cryptographically makes sure everyone gets the same result.
These are all good measures though. It's much harder for Whatsapp to mass attack users this way.
So for wa to do a man in the middle attack they would also need to convince Cloudflare to sign two inconsistent tree heads.