Would active MITM be possible with key login? I would think it should be impossible. If the symmetric session key is chosen by the server and encrypted with th

Would active MITM be possible with key login? I would think it should be impossible. If the symmetric session key is chosen by the server and encrypted with the client's public key, the attacker won't know it and cannot mess with the session. The only thing the attacker can do is completely impersonate the server. But the attacker cannot communicate with the actual server at all.