In addition to being a really succinct and well-written summary of how KCI attacks work and a good motivator for reading on modern AKE constructions like SIGMA work, this is also kind of the best possible Github bug report; in particular, I'm stealing this:
Is this an accurate representation of the handshake? If so, keep reading. If not, you may safely stop reading here, close the issue, and accept my apologies for the misunderstanding.