That makes sense. I know the MITMproxy they mentioned re-signs the traffic, but it will not work unless you install its self-generated cert so I thought it was weird that the malicious exit nodes were using it.

Also, if someone is running a bitcoin exchange that has port 80 open for anything more than a redirect I would not do business with them.