[xnull2guest]

Here Facebook isn't even a man-in-the-middle. They are a 'man-on-the-box'. They get to generate the nonces, keys, etc.

It's pointless to add encryption if Facebook is your root of trust.