Tor doesn't overwrite rotated keys
Tor doesn't zero out rotated onion keys, or rotated x509s and currently leaves them into memory for anyone to have fun with them.
The fact that Tor uses PFS TLS ciphersuites saves the day, but still sensitive stuff should be overwritten to be on the safe side.
Onion keys should get memsetted somewhere around the crypto_free_pk_env(lastonionkey); of rotate_onion_key()
and TLS certificates should get memsetted in: tor_tls_context_decref().
OpenSSL has functions that clean keys correctly, iirc.