Ah, that seems sensible - because if the chain is me -> a -> b -> badsite.onion, and the NSA owns a & b, I'm encrypting to each of those node's keys; and in the

Ah, that seems sensible - because if the chain is me -> a -> b -> badsite.onion, and the NSA owns a & b, I'm encrypting to each of those node's keys; and in the absence of a central Torland CA, I can't trust anything but what's visible. So even if badsite.onion used TLS, I'd be forced to verify their certificate offline or risk me -> a -> b -> badsite.onion (NSA fakery) <=> torchain -> badsite.onion (real) Am I tracking? That's tricky.