looking at the https process, there is a question: why does https need to use a secret key exchange such as ecdh?

keep it simple:

1. the client randomly generates the hash value of the AES secret key AESKey, request data sign
2. encrypt the AESKey+sign using the public key and encrypt the request data using AESkey
3. the data finally sent to the server contains pub.pem.encrypt (AESKey + sign), AES (data)
).
4. the server uses the private key to decrypt AESKey + sign, and then decrypts data
5. the server encrypts the returned data and the AES (response + responseSign), client decrypts the returned data according to the secret key.

the process should be secure, regardless of the man-in-the-middle problem, so why do you need a secret key exchange like ecdh?
suppose you implement an encryption process and the public key is built into the client, so you can also prevent the middleman?