They don't even have to look at the keys, they have the app, can encrypt your messages with their key, or send the plain text contents separately, or who knows what else. Plus your recipients are not encrypted like in signal for instance where security is a foundational requirement. Anyone done any sort of audit?