I've noted that probably all of the 4 popular Software Configuration Management Tools (SCMs), ie.:
use only clients' authentication instead of the server authentication – correct me if I'm wrong (I suspect I'm wrong, but I don't know why).
Why is that? Isn't it unsafe to trust the server that in fact manages nearly every detail of the clients' system configuration?
Here is description of how Puppet's authentication is provided. Isn't it possible for an attacker to run MITM attack by pretending to be Puppet server? Does authenticating clients by the server somehow provides mutual authentication?