torproject.org as a hidden service

Accessing torproject.org through exit nodes is not good. Replace it with hidden service for TBB. Of course, HTTPS over TOR (as Facebook have done) to make use of PKI to verify that it is torproject's site, not John Doe's site.

To prevent attack with registering .onion address by provider just hardcode into TB that .onion addresses MUST be downloaded through proxy. Don't forget about third-party proxy addons, such as FoxyProxy (used in TAILS), make sure that this wouldn't have broken them.