I would continue under the assumption that they can and do. If confidentiality and authenticity is mission critical, you need to be using a hidden service rathe

I would continue under the assumption that they can and do. If confidentiality and authenticity is mission critical, you need to be using a hidden service rather than relying on SSL. A hidden service does not exit the network and does not rely on external validation.