I took a look at obfs4, other bridge protocols may differ.
Let's look at a bridge address for obfs4:
obfs4 220.127.116.11:1516 64F77F8178AAFDD19035F398B28ABCD16C45A7DD cert=BF0SD8D0SBKmW8z4AMF+Ik3SiizaEdgRCrbKNYpLjr1qESQ8vQVLo3H6ioIa8KlhnV/wWg iat-mode=0
You'll notice the
cert=… part, it contains certificate used to authenticate the bridge. It fulfills the same functionality as SSL certificates, it proofs the identity of your peer, the bridge, and ensures data integrity. The certificate is shared amongst all clients. It does not contain sensitive data, so this is secure.
The encryption key itself is derived during the handshake, and is unique. The certificate ensures that no man-in-the-middle attack can be mounted during the handshake.
You can also take a look at the obfs4 protocol specification.