As I understand it, CAs have the job to make sure that the encryption via a passphrase used when visiting a website (https://) stems from the website itself and nobody else. Or that if I exchange public keys with other entities, they stem from them and only them. So, for example, a CA makes sure that when I visit https://stackexchange.com all network traffic is encrypted with the key, that was generated from stackexchange itself and nobody else.
The "only" reason, I can imagine, why CAs exist is that somebody uses a man-in-the-middle attack and sends keys that he, the attacker, created before. Why else would you use CAs? Because when I visit https://stackexchange.com, it is a clear website with a clear IP and everything. They could just send me their key for encryption and everything's fine, isn't it? The only reason I see is a man-in-the-middle attack.
How come, there are, as far as I know, no concepts like CAs in Tor Browsing? You have an onion address (http://hahgstsbsjservbu.onion) and get the key when visiting the hidden service. As far as I know, the key lies somewhere on the server that provides the hidden service. Why are there no CAs?