Thanks for the feedback.
I think the issue is not the order of operations because I have always done exactly what you describe.
So far, I have been cloning the same extra-minimal template that I use for my sys-firewall which is based on this:
with explicitly installed (using --no-install-recommends) only qubes-core-agent-networking. For the purpose of installing your certificate I install gpg in the clone too. That was until now.
Now, I decided to repeat the whole procedure using an original debian-13-minimal and everything worked as you described.
Questions:
- Which other packages from the link above does 3isec-tor need? (if that is the issue with the extra-minimal template)
- How do you protect TorVM against clearnet leaks?