Ok sorry, I did misread you. You’re talking about both parties exchanging the key with the attacker thinking the attacker is the other party. So yeah, you’re right that you’d need some public key system for ensuring the identity of the node you’re talking to.