Why wouldn't SSL help? Unless the offending exit node has the requested site's cert, there's almost no way they can carry out a MITM attack on an SSL request undetected. That's kind of the whole point of certs.
Or is this an indictment of Cloudfront offering to be your SSL termination point?
This is an indictment of Cloudfront offering to be your SSL termination point, and using multiple-domain certs to do it. Here's the Black Hat paper on how to exploit that.
Or is this an indictment of Cloudfront offering to be your SSL termination point?