Key exchange and authentication using libhydrogen
All the key exchange schemes provided by libhydrogen (actually the Noise protocol) are secure against MITM.

With the N variant, the client has to know the server's public key, and will not return a valid shared key pair unless the response comes from a server that has the corresponding secret key.

If you need the server to authenticate the client as well, use the KK variant instead.

Signatures are not needed, unless you want keys to be signed by a certificate authority.