How do applications set up secure communications through an untrusted middleman?
There is no way to establish a shared key with a man in the middle attack and no trusted third party.

With a trusted third party, they can validate public keys so that the man in the middle can't send his.