{verification}

Ah, verification and trust are separate. Cool.

Well, it was like 2 years ago? I had a different Element session than now (new one now for testing), nheko and fluffychat, and I pressed every possible button and nothing happened. When I open nheko, a dialog box says "Activate encryption"; "to make this device trusted {blah blah blah}" with a big "Verify" button. Pressing it does the same as closing the dialog, so a whole lot of nothing. Same right now. I did try logging out and back in on different devices, back then only though.

in tox, it seems encryption is mandatory

Because that's how it's routed, yes. Peer to peer with fewer points of centralization (still there for node discovery and TCP<>UDP tunnels and shit). The message encryption and the transport encryption are the same.

https://github.com/TokTok/c-toxcore/issues/426
Let's say that Mallory, M, has stolen A's private key

I stopped reading there. I mean, good thing to know that it's possible (especially for potential punks using it and whatnot), but I feel like opsec is fucked regardless in this case.