I've tried to obtain a free SSL certificate from StartSSL, but at the time of cert. generation, among the selectable domains, there was no the one I chose (.tk), which are free

So, you must have a "vanilla" domain to get the benefits of certification.

I wonder, if the pump-federation can use other CA authority tree besides the actual; for example Evan can be the top trustee and then he can establish a team of well-known pumpers with own nodes who can sign certificates for incoming pump-nodes.