[StavrosK]

It's always possible to MITM if you can't verify the signatures. No matter what they implement, the server can just relay messages back and forth.