When you visit .onion sites exit nodes don't come into play.
As for controlling a bunch of nodes and figuring out who loads what is not possible, as far as I understand how the network works. How it works is that the sender decides on a path which consists of a random amount of other regular nodes. It encrypts a message with the public key of each of the nodes, and then sends it on its merry way to the first node. None of the nodes know if they're the first, the second, or the last. All the know is the address of the previous and the next node, either of which can be other nodes in the chain or the origin or the destination.
> As for controlling a bunch of nodes and figuring out who loads what is not possible, as far as I understand how the network works.
Given the number of taping points, the NSA might be considered a global passive adversary (or close to one) at this point. Tor does not protect against that.
An entity controlling traffic at your internet connection can force node selection during circuit building by failing requests to uncontrolled nodes. The path bias warning is informational only AFAIK (was added in 2012?) and is not perfect.
As for controlling a bunch of nodes and figuring out who loads what is not possible, as far as I understand how the network works. How it works is that the sender decides on a path which consists of a random amount of other regular nodes. It encrypts a message with the public key of each of the nodes, and then sends it on its merry way to the first node. None of the nodes know if they're the first, the second, or the last. All the know is the address of the previous and the next node, either of which can be other nodes in the chain or the origin or the destination.