Well, you can verify the certificate is the same when accessing the page via your connection and via tor. If they have different chains you stop trusting the ro

Well, you can verify the certificate is the same when accessing the page via your connection and via tor. If they have different chains you stop trusting the root authority. This can be spoofed only if the nation state buys the master root keys (i.e. not just a key allowed to sign any domain, but the root key the provider uses to sign everything, so that the chain is exactly the same) from every certificate provider... At which point you're screwed whatever you do.