BTW from another topic a quote from @schoen:
Congratulations to the authors of the RFC, and thanks to the authors of
the earlier P2P Names Internet-Draft. I hope this leads the CA/B Forum
to agree that it's appropriate for CAs to issue certs for .onion names
in the long run.