>is there something about this stack that would let us stop being a middleman?
Yes if you terminate the connection in the browser and your server just acts as a TCP<->websocket proxy, you can verify the fingerprint and (assuming you trust the JS) be sure the proxy isn't MITMing.
> It looks to me like the node SSH service would still have to be running somewhere
Yes if you terminate the connection in the browser and your server just acts as a TCP<->websocket proxy, you can verify the fingerprint and (assuming you trust the JS) be sure the proxy isn't MITMing.
> It looks to me like the node SSH service would still have to be running somewhere
No.