You only know that the connection has not been MITM if you have actually identified that the public keys that you want to use or trust that they are correct due to a WoT (e.g. they are signed by a CA your OS trusts or GPG WoT).