There is now an official internet standard that makes it possible for Tor onion services to get verified security certificates the same way any website does, automatically, for free. https://datatracker.ietf.org/doc/rfc9799/