they are not blocking tor specifically, just malicous ip addresses, some of which happen to be tor exit nodes,

for those who wish to use tor i think a hidden service is the way to go,
xes does not want a tor node on the infrastrusture, which i think is fair enough
so:

does the tor node need to be on the infra, or can someone host it elsewere, it looks like some kind of port foward?

would a hidden service work for the existing setup ( static.maemo.org for example may cause issues )