If we assume the adversary controls all network traffic as well as all Tor exit nodes but the would-be whistleblowers and the New Yorker's systems are out of bo

If we assume the adversary controls all network traffic as well as all Tor exit nodes but the would-be whistleblowers and the New Yorker's systems are out of bounds, a valid solution is still possible: - The plainly accessible page needs to be served through HTTPS, preferably secured with an EV-SSL cert. The adversary would then be unable to read or change any of the site's content; i.e. the whistleblower receives the correct onion link. - The onion site, too, needs to be served through HTTPS. All traffic passing through Tor is encrypted and thus out of reach of the adversary; traffic leaving Tor for the destination site is encrypted yet again and out of reach as well. Since few CAs would accept to sign certificates for a .onion domain, that site might have to use a self-signed certificate. This solution remains secure for as long as that certificate's fingerprint is posted on the first page and the whistleblower cross-checks the expected and actual fingerprint values. This should provide reasonable security for the exchanged message contents. In all likelihood, though, the adversary would be able to prove the whistleblower did communicate with the New Yorker. One high-risk aspect of this whole deal is a possible breach at any of the whistleblower's trusted CAs. Convergence would be of some help there -- assuming the notaries involved are behaving correctly. *edit: Sorry, I had a bit of a brain fart right there. Traffic to and from the hidden service (the .onion domain) never leave the Tor network and thus remain secure. Skip the second bullet point.