It works like ssh. When you send or receive securely, you can see a fingerprint of your peer's public key, and a fingerprint of your own public key. Your peer sees these too.
To mitigate MITM attacks, ask your peer for their public key fingerprint using something other than WireOver: phone, SMS, email, PGP email - whatever you're comfortable with. That's your "second factor of authentication".
Your approval is cached so you only need to do it once.
We'll better explain this on the website.
