The upstream Tor Project repository,
https://deb.torproject.org/torproject.org, works when accessed directly,
but not when accessed via apt-cacher-ng:

Err:1 https://deb.torproject.org/torproject.org sid InRelease
  Certificate verification failed: The certificate is NOT trusted. The certificate issuer is unknown.  Could not handshake: Error in the certificate verification. [IP: xx.xx.xx.xx 3142]

I don't know if they're doing something wrong, or apt-cacher-ng is. I do
not know if this is related to:

https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=986356

but other third party repos using HTTPS and CNAMES (e.g.,
https://download.vscodium.com/debs) seem to work fine.

The Tor Project documentation:

https://support.torproject.org/apt/tor-deb-repo/