This question already has an answer here:
I am thinking how does telegram ensure that messages are secret. I understand they use the public key to encrypt and private key to decrypt. Why is it not possible for an attacker to download the telegram app to obtain the private key.
Is a private key fixed? Or it is a random generated number. In what way does telegram or any other applications for that matter ensure that their private key is not compromised since the application is freely downloadable.