That's really a non-problem since how could you ever know? The only way to verify that A's keys are legit is to use a secure channel first. Then you can levera

That's really a non-problem since how could you ever know? The only way to verify that A's keys are legit is to use a secure channel first. Then you can leverage that over any number of insecure channels later to reconnect with A.