Channel Binding with HMAC: Preventing Relay-Level MITM Attacks

An HMAC over both sorted ephemeral public keys — keyed by the room secret — prevents a compromised relay from substituting keys during the handshake.