- I can't easily find any mention of it on their clearnet site (but I stumbled across a special search result page) and
- the certificate used on the onion site is not valid for the .onion address, only for *.duckduckgo.com and duckduckgo.com.
Verifying that the .onion certificate is the same as the official one and not from some CA breach is not easy: it seems Firefox doesn't show certificate details in the Page Info when you get a certificate warning. I was finally able to compare them using this command (You can ignore the SSL session differences):
meld \ <(openssl s_client -connect duckduckgo.com:443 -status <<< '') \ <(torify openssl s_client -connect 3g2upl4pq6kufc4m.onion:443 -status <<< '') &
What am I supposed to do as an end user in this situation? Not use HTTPS? Ask DuckDuckGo to update their certificate & web site? Verify the certificate manually each time? Or have I misunderstood how .onion sites work?
(DuckDuckGo is just an example; I'm sure there are other .onion sites with the same issues.)