[noclip]

Why even bother breaking the crypto? They say right on the site that they use HTTP for public key retrieval so a MITM would simply serve up bogus public keys to the clients.