Private Diffie/Helman Tokens

Diffie-Hellman guarantees you have a secure channel between you and somebody else, but it tells you nothing about who that somebody is. Maybe it's the person you wanted to talk to; maybe it's a MitM who's relaying messages between the two of you; maybe it's an attacker who's completely faking the responses. You need another protocol to figure out who the person on the other end of the channel is, and TLS certificates (like Let's Encrypt) are one way of implementing that.