I think you're putting two encryption forms together and getting confused. First you need to look at encryption in two ways encrypting data and encrypting a tunnel.
Encryption of data is done at the endpoint before the information is send over the wire. This can be done using Symmetric or Asymmetric encryption. Symmetric encryption is an exchange of the same keys to encrypt and decrypt data. Asymmetric encryption uses a Private/Public key pair to encrypt and decrypt data.
Encrypting of a tunnel does not encrypt at the data level. It provide a secure tunnel for data to travel over. Plain text can be send over an encrypted tunnel (such as SSL) and to a prying attacker they cannot see the data because of the encrypted tunnel. This is what we refer to as PKI or most commonly SSL certificates.
Both of these forms can be used separately or together.
If you use both methods, and attacker must first break the tunnel. Various methods exist as your posts have discussed, but more to your point of MITM attacks, placing a malicious host between the user and the server can allow and attacker to capture data.
If this data is not encrypted and only in plain text an attacker has all they need and can see passwords/username/etc send via plain text.
If however the data is encrypted itself, the attacker can capture the encrypted data, but in order for them too gain access to the information, they would need the keys to that encryption.
Finally back your question as to MITM attacks used to impersonate sites -- No, MITM by there design are for eavesdropping without detection on users. Impersonation attacks are normally in the form of an attacker impersonating a user, or an attacker posing as a legitimate site.
Technics such as XSS or CSRF are not MITM attacks per say, and are more an exploitation of trust between a site and it's users. In these instances, they are either presented to the user in the form of client side scripts which come from legitimate sites an attacker has compromised, or presented to servers where an attacker has compromised a legitimate user.