Sorry to necro this thread, but there have been new developments in the field of Tor Hidden Services:
https://blog.torproject.org/blog/new-and-improved-onion-services-will-premiere-def-con-25
Tor will soon launch a new hidden service format that will have much stronger naming. Do you know if the next generation onion services will be eligible under CA/B rules for DV SSL, and if so will Let’s Encrypt support next generation onion domains?