(FWIW: on the client side there is still the HTTPS-only mode in the pipeline, which could easily be a game-changer here, too.)
Is the torproject backporting https-only mode [1] to 78esr / Tor Browser?
kind regards, nusenu
[1] https://blog.mozilla.org/security/2020/11/17/firefox-83-introduces-https-onl...