Today? Use their .onion address[0] over Tor and TLS. The TLS certificate is secured by the tor secret service key. No WebPKI or centralized CAs required.
For tomorrow we should keep exploring and adopting improvements. Pick your poison.
[0]: Discovery left as excercise for reader