As I understand it, when two systems create a secure SSH tunnel, the first step involves communicating the 'guidelines' for the encryption of that tunnel. If an third system is able to listen in on this initial conversation, wouldn't it be able to decode all of the data that is sent through the tunnel? How is the tunnel secured if the initial conversation is conducted across a public connection?
Though the question is about SSH, the same concept as in SSL apply, so see this answer which explains it all.
Short summary: it's magic. Asymmetric cryptography magic, to be precise.
The good old safe-with-two-locks analogy:
This is the basics of how exchanging private information over a public network works, with an asymmetrical key for each participant.
Through this mechanism, Alice and Bob are able to exchange information as to how to establish the encrypted connexion.