Does DTLS in WebRTC protect from active Man-in-the-Middle? I wonder if it does. It seems to me that there is no way for participants to authenticate each other securely. There are, though, signaling servers, but I don't think that they are capable of key distribution.

Is there something I've missed?
WebRTC uses DTLS-SRTP and according to RFC 5764 DTLS-SRTP supports certificates for both client and server.
However in the context of WebRTC the direct connection established between the users is established by dynamically downloaded software running in the browser.
In other words the user does not control the software so even if the software did provide him with ways to secure the connection it could be replaced by other software that does not.

This is the same problem as faced by all kind of web based mail encryption systems.

It's nicely treated in this RFC draft:


  In general, it is important to understand that unlike a
  conventional    SIP proxy, the calling service (i.e., the Web server)
  controls not    only the channel between the communicating endpoints
  but also the    application running on the user's browser.  While in
  principle it is    possible for the browser to cut the calling service
  out of the loop    and directly present trusted information (and
  perhaps get consent),    practice in modern browsers is to avoid this
  whenever possible.