What is the user supposed to do when they get notified of a "safety number changed" message? How do they verify they've not just been MITM? Honest question... I don't use whatsapp or signal at all.
It's up to you to confirm what's going on using another channel (say call them on phone and see what's going on, compare the numbers). It's the same thing ssh does when server keys change for instance. To me it's a reasonable way to handle such situation.
You have to physically compare the numbers on the two phones (in real life), or send the numbers through a different trusted channel (PGP, USPS, Carrier Pigeon, etc).
You can aks the other party to resend you a message from before (one that doesn't matter).
Ie. Can you confirm this is you: send me a message from 5 messages back using the quote function. (you know what is said 5 mssgs back so you can pick a non sensitive one, and they can do the same to you)
edit: nvm, if this is man in the middle then that doesn't matter because you still exchange with each other and its not a hijack.
Sorry, I made a mistake.
