A deep packet inspection/modification firewall or proxy could replace the in transit public keys with ones of their own, allowing for intercept, decryption and modification of messages being sent. Possible solutions are out of band key distribution covered in #11 or some form of established protocol like TLS negotiated over the CID channel which requires further investigation before drafting an enhancement issue.