WhatsApp is used by billions, and uses (at least in theory) e2ee, so I don't think usability is a real problem for e2ee
I am not singling out WhatsApp here. In a usability study involving Signal[2], 21 out of 28 computer science students failed to establish and maintain a secure end to end encrypted connection.
[1] https://faq.whatsapp.com/1524220618005378
[2] https://www.ndss-symposium.org/wp-content/uploads/2018/03/09...
is this everything?
Assuming one of those billions users is a motivated security enthusiast, WhatsApp is not able to perform MITM attacks at scale, as it would be trivial to prove. If WhatsApp decides to MITM your chats, it can't do so retroactively due to the properties of the protocol. If you're a high-profile target, you should verify your keys.
Can't they just set you up as a new device? The user wouldn't know if they left the notification at the default setting.
Whatsapp would not MITM ever single user. They would carefully target particular individuals.
But let's assume the client app was open source, and WhatsApp decided to reset the key for some targeted users. Most users wouldn't realize, but if one did, then that would be very bad for WhatsApp. It would be all over the media. That's why it cannot be done at scale.
That's why it cannot be done at scale with Signal, too. Even if the users mostly ignore the "new key exchange" notification. If Signal MITM conversations and one person manages to prove it, then Signal is done. That's a pretty strong incentive for them not to do it.