Just to clarify, HTTPS would not be of any use if the sole verification you make is technical (eg like letsencrypt which verifies that you indeed control the en

Just to clarify, HTTPS would not be of any use if the sole verification you make is technical (eg like letsencrypt which verifies that you indeed control the endpoint, vs say <commercial CA> that may verify IRL that you are the social entity you say you are). tldr: if you trust the onion address to be correct, the connection is already end-to-end encrypted to the only person that generated and thus controls the endpoint. I didn't look into onion addresses in some time so correct me if i'm wrong, but basically the address is a certificate: a locator and a key (both being the same thing but still). Links are authenticating by default, as if you bundled a letsencrypt certificate in the url. Some keywords to explore further: cjdns (same thing on osi level 3), capability-based security (tying an name [in the sense of URN] and a key), content-based addressing (can be seen as a variant when content is static, in tor the name points to a channel and not a blob so the content is the key).