It uses Diffie Hellman to come up with one-time session key, then have the server sign this session key to allow the client to verify that there's no man in the middle.
