What would prevent WhatsApp from shipping a client where they control the rekeying notification setting remotely?

I suppose there must ultimately be some level of trust in WhatsApp that the client is doing what it says it is? Unless we're willing to sniff every piece of network traffic from it.