Tor does not provide security, it can provide obfuscation that may lead to anonymity or pseudonymity, not more.

I concur with your statement that SSL isn't really secure end-to-end communication when 3rd party certificates are involved.