One way to understand this is through a rather abstract and constructive viewpoint, abstracting away specifics.
As you mentioned, a DH key exchange needs to be done in an authenticated manner otherwise man-in-the-middle attacks become possible. In other words, we needs the communication to happen on a authenticated channel.
How do we get an authenticated channel? One way is to use digital signatures. They would allow to verify that the message comes from the legitimate sender. However we still have a problem, the verification keys needs to be transmitted somehow and so far we only have an insecure channel.
In order to resolve this problem, we send digital signatures parameters over an authenticated channel that is obtained by using certificates. If we trust certification authorities, we have indeed an authenticated channel.
Everything put together in a constructive way:
1) Using certificates we construct an authenticated channel that allows exchange of digital signature parameters
2) Using digital signatures, we construct an authenticated channel that allows key-exchange(D.H).
3) Using key exchange results we could also construct a secure channel.