Assuming I select "check certificates using Tor", can I safely turn this feature on without compromising my anonymity?
Will this protect me against (or warn me about) a malicious exit node trying to perform a mitm attack on TLS connections?
I'm the maintainer of HTTPS Everywhere, which includes SSL Observatory (off by default though). I'm not sure where the other commenter got the idea that we're sending anything to Google; we don't.
When you enable SSL Observatory, we POST a copy of the certificate chain you saw to an EFF server, along with the time, server domain, and server IP address. We don't keep logs of your IP address, but for extra anonymity, we try to send the POST request through Tor if you have Tor installed. You don't have to be running Tor browser for this to happen.
HTTPS Everywhere ships with a whitelist of common certificate chain fingerprints, so it doesn't send anything that we've seen enough times before (ex: most Google certificate chains).
Currently it does nothing to inform you in real time whether you've been attacked. This is a feature that we're working on adding.
According to an entry on the EFF site it sends a copy of the certificate, when used with Tor the EFF does not learn who send the certificate.
If you turn on this feature, it will send anonymous copies of certificates for HTTPS websites to EFF's SSL Observatory database, which will allow us to study them and detect problems with the web's cryptographic and security infrastructure.
Now to the part what it protects against.
The Decentralized SSL Observatory is also capable of giving real-time warnings about these problems.
There doesn't seem to be a description of what it actually tells you when they detect that the certificate for xyz.com does not match with what's known to them.
wireshark will show traffic originating from "HTTPS Everywhere" plug-in going to google. As far as I understand, "HTTPS Everywhere" consults a list hosted by google.com. So by using "HTTPS Everywhere" you tell google all the https site you are visiting.