Stack Exchange network consists of 183 Q&A communities including Stack Overflow, the largest, most trusted online community for developers to learn, share their knowledge, and build their careers.
If the private CA key was stolen in a breach, and there were new certificates signed issued around that time, there is always a possibility the passphrase was stolen as well. So having a passphrase doesn't really add much to security in this scenario.
No, we do not know the IP of the hidden service. We know some hash, which can be used to find Rendezvous Points for a specific hidden node (of which you don't know the IP either). The hidden server communicates with the same node (but again not directly, so neither party knows each other IP).
It depends. The UEFI "infection", which installs another UEFI loader, is easily removable IF you are able to enter your BIOS setup and IF it allows you to change UEFI settings. There is however malware "BadBIOS" which flashes itself into BIOS - this is much harder to remove, and might require hardware modifications for removal.
OpenVPN is one of them, but there are many alternatives. If you use your own scripts or a browser which supports SOCKS5, you can even use something like ssh tunnel (however in this case the server might be able to find out your real IP)
