Key exchange and man in the middle issue. Secure solution
You are right that the session public keys can be replaced if they are not signed by long term private key known to all parties.

What you want to do is not have Trent do anything but be a relay, then you need a standard key exchange process between the two parties using new random key pairs. Then once all parties have both public keys, they can generate an authentication hash of the key pairs as well as the prime/exponent and any other common data. After the key exchange completes and the session key is generated, you would need some way to compare them, even if it is an insecure channel, as long as that comparison cannot be modified.

Several programs use this method or one like it. I use one over IRC, with the IRC server taking the place of Trent. The obvious alternative is known long term keys that are only used for signing the session public keys.