So your point here is "don't bother"? Whilst you make some valid assertions, I disagree with the conclusion. It's trivially easy to use a live CD/DVD based VM

So your point here is "don't bother"? Whilst you make some valid assertions, I disagree with the conclusion. It's trivially easy to use a live CD/DVD based VM containing Tor which has no ability to run vulnerable content (java, javascript, flash etc) nor any ability to break out of its proxy (iptables user match, authorise the anonymous user to only communicate with privoxy, privoxy with tor, tor with valid tor end points and drop all other traffic). That leaves only the malicious end point you mention - it seems that your assumption is the only valid use of Tor is to access the regular internet. Setting that aside, the browser need only be configured to use SSL everywhere - that can even be done at a proxy level rewriting all pages to force SSL before delivery to the browser. Coming back to the malicious endpoint, who cares? The only circumstances in which you do are those in which you've leaked identifying information in cleartext in which case why use Tor in the first place? In all other circumstances ...