Messaging apps such as WA or Signal have no means of verifying keys, require phone numbers tied to the users’ real identity, operate based on a client-server model in which the server could be compromised by well-resourced agencies and require black-box phones that are not secure against phone manufacturers and agencies with whom they collaborate.
Users should be warned of perils of phones not quite under their control. Set up a proper FOSS machine that you understand, and use own encryption (be it PGP or some other tool serving the same purpose).
Verifying a public key over a secure channel works trivially for any public key cryptography system.
I was referring to ways to establish such secure secondary channels. Either verify a key yourself, eg, in person, or use distributed trust to average out the noise.
For example, keybase has an approach: linking various identity information to keys.
Signal is secure in a strange narrow interpretation of the security. There are problems if you look more broadly.
Users should be warned of perils of phones not quite under their control. Set up a proper FOSS machine that you understand, and use own encryption (be it PGP or some other tool serving the same purpose).