Tor: Why does HTTPS still matter when using Tor?

Short answer

Tor encrypts traffic inside the Tor network, but an ordinary website is reached from an exit relay. HTTPS protects the connection from that exit to the website and helps authenticate the website. Before entering a password or payment information, check the address and secure connection indicators. An onion service uses a different end-to-end encrypted connection within Tor.

Sources

Tor Project: Secure connections, Tor Project: Onion services.