Oh right, that is a good point. I suppose Digicert is the only option for now then. Perhaps the Tor team or an affiliate could set up a simplified CA and have

Oh right, that is a good point. I suppose Digicert is the only option for now then. Perhaps the Tor team or an affiliate could set up a simplified CA and have a public CA cert restricted to .onion that folks could install as a work around to having browsers trust it by default.