I know it was bullshit when it first launched, but they completely rebuilt the message protocol later on. Shit, now you’ve got me worried, time to do research.

Edit: Nah, it looks like it uses a perfectly valid key exchange algorithm. Maybe it goes via a WhatsApp server, but you shouldn’t care because the algorithm is interception-proof.