Very good point. I've actually considered trying to get an EV .onion TLS cert, but this is probably overkill, and then forces me to rely on the CA system, and is of course probably a PITA.