But since anyone can act the same as the IoT device, there's no way to prove that the IP you're connecting to is the same device and not a MITM, other than if y

But since anyone can act the same as the IoT device, there's no way to prove that the IP you're connecting to is the same device and not a MITM, other than if you've been to that host and accepted it's key and the system warms you in key changes. Since it is decidedly not TLS, we should call that protocol something else. HTTPC perhaps then use SSH protocol on the outside with HTTP on the inside. Port 223/TCP.