I do still notice CAPTCHAs for bare requests to the top-level domains of
paid sites. Is there a plan to roll this out for all CloudFlare sites at
some point for Tor traffic?
Also, I will see what we can do on our side about reviewing the spec and
the browser extension, taking Georg and Jeff's comments into
consideration. Is there a timeline for when that system will be ready on
your side?