This may not be needed if TPO switches to Let's Encrypt for its own sites. It would be as simple as trusting their CA without worrying about expired certs or MITM.

Security comparison:

Self-signed cert > Let's Encrypt > Current CA model

Our options are limited but what TPO decides to proceed so we need to ask them and get an idea.

To be researched: The implications of NSLs on Let's Encrypt's security.

letsencrypt should go into it's own ticket. Not good to have it under
"direct SSL certificate pinning".

https://lists.torproject.org/pipermail/tor-talk/2016-February/040462.html

Key level pinning is not coded yet but planned. Lets Encrypt logs can be checked by users for signs of strange behavior or sudden key changes. Lets Encrypt aims for great transparency and will fight to defeat NSLs but As a CA this type of legal attack can happen. Sticking to the previous idea of direct cert pinning makes more sense for usability and security IMO.

We can now grab the browser tarball from the TPO onion instead which makes this ticket obsolete. Close if you concur.