Hacker News Reader

I may be missing something but this seems highly susceptible to man in the middle attacks

If the web page was served over HTTPS and provided the SSH server's fingerprint for the user to verify, wouldn't that get around the MITM risk?