Even if Alice and Bob's public keys are stored on a datavase, this attack will work. Mallet can intercept Alice's database inquiry, and substitute his own public key for Alice's. He can do the same to Bob.