How does site authentication work in Onion world? With those unrecognizable URLs, it seems like it'd be easy to set up a phishing site that leaks the whistleblower's identity.
Vanity addresses, ones that have a name at the beginning, require some processing in order to find the right public key.