From my quick look at code, i found out that there is key exchange public key signing in source, but no way to set keys for it are provided in the interface. (It is possible to set them through certificates, but certificates don't look like they are made for usage outside Steamworks).
And my question is: can i set keys for signing and verifying key exchange public keys using only interface?
If no, i think it's worth considering adding some simple API for that, for example:

AddKeyExchangePublicKeys(CECSigningPublicKey* keys, size_t keyCount);
SetKeyExchangePrivateKey(CECSigningPrivateKey key);

(CECSigningPublic/PrivateKey are here for example)
I think, it will improve protection against MITM.