> But key exchange goes through Whatsapp (Facebook) servers. So they could give themselves access easily enough if they wanted to.

The key exchange going through their servers isn't so much the problem; public-key cryptography solves this. The problem is that the clients are closed source.