What prevents a MITM attack in E2E chats?

Question

Information Security

As far as I know, E2E encryption in modern messengers is generally implemented as follows:

1. Users generate a public-private key pair
2. Users send public keys to each other (through the server, of course)
3. Users encrypt sent messages with someone else's public key and decrypt received messages with their own private key.

What prevents the messenger server in this scheme from replacing public keys with its own and carrying out a MITM attack?

Yes, I understand that enthusiasts can contact via an independent channel and understand that the generated and received public keys differ, but after all, the server can carry out such attacks not on everyone in a row, but only on individuals of interest to it.

Answer 1

Nothing interferes. For E2E to work, it is necessary to verify public keys in a trusted way.

Answer 2

For example, when calling in a telegram, they offer to check the set of emojis shown, i.e. this is a fingerprint check of the key.

Answer 3

Nothing interferes :)
That's why they say that all this security is exaggerated. It may be from a third party and security, but not from the chat admins.

Answer 4

I'm not an expert, but I'm sure that's not how it works. Asymmetric cryptography in general is mainly used for signatures, and not for encryption itself. For E2E, as well as for TLS, one of the Diffie-Hellman variations is most likely used.