TOFU (Trust on first use) + Verification

**Is your feature request related to a problem? Please describe.**

E2EE is of very limited use if you can’t prove whether you’re talking to the right person or a MITM.

**Describe the solution you'd like**

Ability to view the olm public keys of the user you’re talking to, and be warned if they change, and have the option to verify them via device verification (and/or via some other out-of-band verification channel, e.g. an ID server)

This is quite subtle given trusting the website hoster to embed a non-malicious chatterbox means that even with verification, there's a risk of a malicious chatterbox being inserted into the mix if the host website wants to MITM its users. Suggestions welcome on how best to solve this one, as verification is useless if you can't trust the endpoint...

**Additional context**
https://news.ycombinator.com/item?id=32020476
https://twitter.com/MTRNord/status/1545089701698306050

Start by reviewing the TOFU, public-key change warnings, device verification, and out-of-band verification requirements in the issue. The issue provides no files, tests, or entry points and leaves the endpoint-trust design open; completion would require an agreed implementation scope and verification criteria.

Written by the indexing model from the issue text.