SIGAINT email service targeted by 70 bad TOR exit nodes
    I know we could SSL sigaint.org, but if it is a state-actor 
    they could just use one of their CAs and mill a key.

Please don't use that argument. It's like not putting a lock on your door because thieves can just bust it open anyway.It's true at face value, but you are ignoring that a) it keeps smaller attackers at bay and b) it makes noise when it breaks. In case of SSL the noise is that a user receives a valid but unusual certificate, which can be caught by something like the SSL Observatory (http://tor.stackexchange.com/a/1879).