The Tor system does scale, as Tor itself proves. Tor just lacks domain names all together and reuses public keys for site identification instead.

Is the tor node you're accessing the real Facebook or just a phishing page intercepting your credentials? Better check if the 60 character domain name matches the one your friend told you about!

I don't think putting any more power in browser vendors is the right move. I'd rather see a DNSSEC overhaul to make DANE work.