Apparently, any exit relay may steal some private data from HTTP requests (like auth data / cookies / credit card information), if the connection itself is not encrypted.

Does HTTPS provide a reliable protection against this? AFAIK HTTPS is vulnerable to Man-In-The-Middle attacks. Is there either a way to ensure that any particular exit node does not perform this kind of attacks or a reliable mechanics that prevents exit relays from doing that?