I've recently been looking at ProtonMail, an email service which provides transparent end to end encryption between users with PGP. In order for the encryption to be transparent, ProtonMail manages all of the public and private keys.
When sending an email from a ProtonMail account to another ProtonMail account, the ProtonMail server sends the destination's public key to the client. The client then encrypts the email using the given public key and sends the mail to the server to forward to the recipient, who can decrypt it with their private key.
Since ProtonMail's server only ever sees the encrypted email, and it doesn't have access to any cleartext private keys, it cannot read the email. According to ProtonMail, this means we don't need to trust the ProtonMail server to know it doesn't read the email (assuming it doesn't send malicious javascript with the client).
However, what, if anything, prevents ProtonMail's server from conducting a man in the middle attack by sending the wrong public key? If the server sends the public key corresponding to a private key they control, they could decrypt the email, then re-encrypt it with the correct public key, and send it to the intended recipient. In normal PGP the user must explicitly mark each public key as trusted, but no explicit trust is requested from the user of the ProtonMail client. So how does the ProtonMail client know to trust the public key sent by the server?