Based on this question, I've discovered that the signaling channel for WebRTC must be trusted in order to prevent MITM attacks. This is unfortunate for a P2P use-cases where the signaling channel is some 3rd party device.
One idea I had is to encrypt and authenticate the WebRTC signaling with libsodium box algorithm. This assumes that both peers know each other's public keys.
Would this solve the MITM issue?
Just to add some additional clarification because I frankly don't really know what I'm doing:
Now suppose each peer subscribed to their public key on signalhub. When peerA wants to connect with peerB, peerA uses peerB's public key, boxes the signal from simple-peer with libsodium, and broadcasts the message on signalhub to peerB's public key channel. When peerB receives this signaling message, it can decrypt and authenticate that the message was sent from peerA.
This intuitively feels secure to me. A MITM could attempt to signal to peerB, but wouldn't be able to authenticate as peerA. Also the MITM couldn't decrypt the signal from peerA so they couldn't respond pretending to be peerB either.
As I understand it, once the signaling is complete and the WebRTC connection is established, the P2P channel is end-to-end encrypted so at this point we should be secure.