Ok so the issue is authentification of the identities. This doesn't seem to be a solved problem in any space, even HTTPS is vulnerable to this kind of attack.

It could be decentralized through pluggable identity authorities which provide the public key transfer via a secure channel. Essentially you'd use the same protocol and select what servers (WhatsApp, Signal, maybe some sort of immutable ledger elsewhere) to use.