>>51035378a MITM doesn't have to be in your network. it could be anywhere in the route between client and server. like a rogue ISP.
as long as all traffic flows through them, they can completely circumvent public key cryptography by inserting their own keys into the flow. neither client nor server will be able to tell the difference.
doesn't work for pre-shared keys, but again, that's not really practical, because you'd have to set it up before the MITM came into play (like from a completely different connection). and it's completely out of the question for most applications like, say, browsing - because you can't just push some key to google's webserver.
