So it goes something like this 1. Attacker does TLS-MITM with rogue certificate to replace the the public key of user B on their website with the attacker's pu

So it goes something like this 1. Attacker does TLS-MITM with rogue certificate to replace the the public key of user B on their website with the attacker's public key in real time 2. A gets the MITM attacker's public key instead. 3. A sends introductory message containing their public key. 4. MITM replaces A's public key with that of theirs with colliding fingerprint 5. MITM keeps reading messages in between. Later when they meet and compare public key fingerprints, they won't detect the attack. This makes a lot of assumptions, but it's merely complex in terms of number of steps. It's not computationally infeasible. Also, a better attack is of course to just hack the endpoints and exfiltrate private keys and passively read all messages since PGP lacks forward secrecy, and since that's according to Snowden, been happening for over 10 years, it's probably the modern approach. Much less noisy.