> This is technically still MitM'able, but only if you catch two parties on their very first connection

Ah, haven't realised it was Trust On First Use (TOFU)--neat!