>So they try to prove identity using a CA-cert, >then wrap encrypted onion traffic in another layer of >encryption. Typo. Not enough coffee. Enclose https in onion encryption. Worse even than using a tor exit.