Spoiled onions and Tor exit relays

I have seen such a Main Authority certificate once before on LWN. Firefox angrily flagged it, so I went on IRC to ask others to confirm the cert fingerprints. They did not match, so I shrugged, started a new Tor circuit and tried again, successfully.

I've always assumed my exit nodes are malicious. For example, any passwords I enter on non-SSL sites over Tor are probably being recorded. To be honest, I'm surprised only 2.5% of exit nodes were overtly modifying traffic like this.

As an aside, I found it very frustrating to be unable to copy-and-paste SSL fingerprints out of Firefox's Page Info window. I suppose I should file a bug about this.