Part four of this post also discusses HTTPS certs for .onion sites: https://blog.torproject.org/blog/facebook-hidden-services-an...
Reply on news.ycombinator.com