Is OMEMO vulnerable in case of compromised jabber server? As I've understand OMEMO protocol specification, the initial key exchange between Alice and Bob can be stored on server and in future used for message decryption.

Also the phrase from Conversations, Jabber Android client, official site:


  This way, not only your messages are safe but more importantly it is impossible for an outside attacker to intercept your meta data (with whom you are chatting) without attacking your server first.


So, does this means that OMEMO is secure only if server and its administration can be 100% trusted?

Does this mean that OTR with its worse usability has better security?
Suppose Alice has never met Bob before—never in her life heard of this ‘Bob’ personage.

Bob initiates a chat with Alice over a Jabber server, which facilitates (a) sending the messages along, and (b) giving Alice and Bob each others' public keys for the first time.

They do a Diffie–Hellman key agreement, of course, so that a passive eavesdropper has no hope of finding the conversation key from the network transcript (more details of how it works).  But Mallory, a NITM (enby-in-the-middle) may have compromised the server.  Here are three possibilities:


The server is honest and uncompromised.  In this case, Alice and Bob get to have a secret conversation about how many Nazis are on Twitter and how many statist tools advocate state surveillance and censorship to suppress the Nazis without realizing—or perhaps without saying—how dangerous state censorship regimes are for marginalized groups like queer people.
The server is compromised by the NSA.  In this case, Alice is actually having a conversation with her personal FBI agent Mallory, who is collecting dossiers on anarchist agitators like me who threaten authoritarian state surveillance regimes.
The server is honest and uncompromised, but Bob is Alice's personal FBI agent Mallory who is collecting dossiers, etc.


If Alice has no prior information about Bob, she has no way to distinguish these cases, no matter how secure the protocol is.  It's the same for OTR, OMEMO, WhatsApp, Signal, the post, or Twitter.