Sorry, I may have misunderstood based on which kind of MITM you were talking about here :) For the points you bring up, at least in the current nerfed extensio

Sorry, I may have misunderstood based on which kind of MITM you were talking about here :) For the points you bring up, at least in the current nerfed extension they aren't really an issue. Key exchange does not happen through the extension or through yahoo, it has to happen out of band. In addition, since this is just the developer preview, AFAIK there is no extension distribution except through github (and so no updates to auto-download). You have to build and install the extension yourself. Key exchange and extension verification are still two difficult remaining problems, but they are hopefully not insurmountable.