When using the Tor browser bundle, you load the
check.torproject.org on start. It tells you when there is a security update to downloads, and let's you click a link to get it.
The way for users to know it's a legit site is to 'check for the hang lock'. It's there and green, and the certificate info is correct, so the user clicks the link and downloads the browser bundle.
If and NSA runs an exit node, they can by the power of law (may be secret or not yet exist) create fake certificates and bypass browser security. Can they then redirect the data from their own server instead of the one run by the tor project? If so, why can't they secretly serve a Tor browser bundle binary with malicious code and a key logger?