What prevents ProtonMail from sending me the wrong public keys? I've recently been looking at ProtonMail, an email service which provides transparent end to end encryption between users with PGP. In order for the encryption to be transparent, ProtonMail manages all of the public and private keys.

When sending an email from a ProtonMail account to another ProtonMail account, the ProtonMail server sends the destination's public key to the client. The client then encrypts the email using the given public key and sends the mail to the server to forward to the recipient, who can decrypt it with their private key.

Since ProtonMail's server only ever sees the encrypted email, and it doesn't have access to any cleartext private keys, it cannot read the email. According to ProtonMail, this means we don't need to trust the ProtonMail server to know it doesn't read the email (assuming it doesn't send malicious javascript with the client).

However, what, if anything, prevents ProtonMail's server from conducting a man in the middle attack by sending the wrong public key? If the server sends the public key corresponding to a private key they control, they could decrypt the email, then re-encrypt it with the correct public key, and send it to the intended recipient. In normal PGP the user must explicitly mark each public key as trusted, but no explicit trust is requested from the user of the ProtonMail client. So how does the ProtonMail client know to trust the public key sent by the server?
ProtonMail has a support page about this topic.

ProtonMail does not transparently solve this problem. By default, the client has no way to know if the server has provided the correct public key, it just implicitly trust keys sent by the server. Therefore, by default the client has no way to protect against man in the middle attacks from the ProtonMail server.

However There is an option to turn on manual trusting of keys, "Settings > Security > Address Verification (optional) > Prompt to trust keys". In this case, when encountering an unknown public key, the ProtonMail client will notify the user that the key is not trusted, and prompt them to "pin" the key. Keys must be pinned, per contact. Messages to contacts without pinned keys will be sent using keys from the ProtonMail server.

A pinned key is stored locally the client, and (presumably) encrypted and sent to the server, so it can be used from other devices when decrypted with the user's password. The client will always use the pinned key to encrypt messages for the corresponding address, and it will display an error if a message received from that address isn't signed with the correct key. It up to the user to verify that the key is correct, like in normal PGP.