CAcert is a community based approach to create a certificate authority. Many sites use it (i.e. CCC). However the root certificate is not yet present in major browsers and also not in the Tor Browser Bundle. I consider them as a trustworthy organisation and really would love to see the root certificate in any browser.
Seems like Tor Browser developers are overworked. There is a development ticket, which hasn't been rejected. Too many more important issues. It would help, if someone knew how their certificate could be added to the source code / build process of Tor Browser. And if someone would provide patch to actually add the certificate. Also answering related questions on how to stay up to date, how to get informed about certificate updates (if that is a valid question at all, but surely a question a developer has, when being asked to include certificates in such a giant project as Firefox).
Update: See also the duplicate ticket for plans.
The Tor Browser Bundle uses the certificate authority list that is created and maintained by the Mozilla Foundation (aka the default certs that come with Firefox). Mozilla has a strict policy for what can and cannot be included in their list, and a large developer base that will hear about breaches, attacks, etc. and can respond fairly quickly to revoke a certificate or add new ones that meet their criteria. There are many, many CA's, and not that many Tor developers; it makes sense to use the existing certificates that are maintained by a much larger (and more experienced in this field) community. This is (hopefully) a safter, more secure route for everyone.
The inclusion status of CACert in Firefox (and therefore in the TBB) can be found on Mozilla's bug tracker as Bug 215243. It is essentially awaiting an independant audit and a resubmit from the CACert team.
