A campus messaging app uses Diffie-Hellman key exchange for students to share notes. Here’s how it works:

1. Students publicly agree on:
   Prime and base .
2. Alice picks a private secret (e.g., , computes , and sends A to Bob.
3. Bob picks a private secret (e.g., , computes , and sends B to Alice.
4. Both compute a shared secret key to encrypt messages:
   Alice:
   Bob:

An attacker intercepts and , impersonates Bob to Alice, and sends fake exam answers (e.g., "The answer to Q3 is 42"). Alice trusts the message because she thinks it’s from Bob.

How does this scenario shift responsibility for security from the app developers to the users?