The "initial key exchange" is performed before any communications are attempted (at setup time). The article specifically mentions "shared secret". By definition, this excludes a MitM type attack, unless the MitM is also in the circle of *allowed* communicators