From Wikipedia, I understand that
Using asymmetric key cryptography, the originator obtains a public key from the directory node to send an encrypted message to the first ("entry") node, establishing a connection and a shared secret ("session key").
This makes sense to me; the client and first relay node communicate an authenticated key exchange, as they know each other. However, Wikipedia then goes on to say
Using the established encrypted link to the entry node, the originator can then relay a message through the first node to a second node in the chain using encryption that only the second node, and not the first, can decrypt.
How can the client and relay node 2 negotiate a key exchange that tunnels through relay node 1 without relay node 1 having the ability to act as a man in the middle and modify public keys that go through the connection.. Wiki says that "only the second node, not the first, can decrypt it". How can the second node decrypt the data without a key exchange taking place, and in such a way that node 1 can't read this data?