Is there a standard way to secure peer to peer communication?
I'm currently using HTTP to transfer data from peer to peer, however, securing with TLS/SSL normally requires a certificate authority to authenticate identity, and using a self-signed certificate hard coded into an application means it's extractable which would still allow MiTM.
Would creating a certificate on first-run be appropriate, then have the UI display the certificate's fingerprint so the users can verify identity out of band? Or would it be more appropriate to just encrypt the bodies being sent over HTTP with some other library (because rolling my own would be an exercise in making security holes). If so, what are the patterns and libraries that one would use (ideally cross-platform)?