> Yes you are wrong :D If NSA is not actively man-in-the-middling you, Perfect forward secrecy still works.

OK, I guess I was reading too much into the (not very enlightening) definition of PFS on Wikipedia and too little of the actual implementation based on Diffie-Hellman, which has the desired properties.

The question that arises is: how feasible is a MITM attack on this phase of session initiation? Can it be kept undetected?

With channel id, it would need to share the state even as laptops move across networks.

They don't have to take an active role though if they just sniff all the traffic, right?

They won't have access to the temporary keypair that the server generates, and which lives only on the server.

Yes, they do.

Whoops. This wouldn't be the first time I got public/private key schemes muddled in my head.