I'm developing a network where two parties that want to join both compute ephemeral ECC keys for a key exchange, to create an encrypted connection. I plan to authenticate these keys by signing them with a pre-shared ECC key. However, how should these PSKs be transmitted in a secure way to prevent MITM attacks that change the PSKs??
There is no magic solution. Either both parties are in a direct contact to exchange a PSK, or they use authentication based on PKI. Otherwise there is no guarantee that there is no man in the middle.