If the web page was served over HTTPS and provided the SSH server's fingerprint for the user to verify, wouldn't that get around the MITM risk?