add a DNS CAA record to
A DNS CAA record can help reduce the risk of rough or compromized CAs.
The domain torproject.org has currently no DNS CAA record.
https://en.wikipedia.org/wiki/DNS_Certification_Authority_Authorization
CAA record generator: https://sslmate.com/caa/