[orbisvicis]

Without https can't the last relay snoop the traffic?

edit: oh, is the last relay the onion service? So the entire chain is encrypted?

[rendx]

The key used to encrypt traffic is in the URL, everything including path is encrypted from client to the onion service end. What you are saying is true for non-onion HTTP sites, not for onions.

[edm0nd]

side note: there is a built in flag mechanism called BadExit for Tor that if a relay or exit is detected to be malicious, it is quickly removed from being used.