Pin *.torproject.org's certs in TBB
TBB should do a hardcoded check for the *.tpo certificate to prevent MITM attacks.
Mozilla does the same for their update mechanism (addons and browser).
https://lists.torproject.org/pipermail/tor-talk/2011-July/020784.html
To upload designs, you'll need to enable LFS and have an admin enable hashed storage. More information