Tor uses multi-layer encryption that addresses this very problem.
From the Tor Project FAQ :
Tor passes your traffic through at least 3 different servers before
sending it on to the destination. Because there's a separate layer of
encryption for each of the three relays, Tor does not modify, or even
know, what you are sending into it. It merely relays your traffic,
completely encrypted through the Tor network and has it pop out
somewhere else in the world, completely intact.
A bad first of three servers can see encrypted Tor traffic coming from
your computer. It still doesn't know who you are and what you are
doing over Tor. It merely sees "This IP address is using Tor".
A bad third of three servers can see the traffic you sent into Tor. It
won't know who sent this traffic. If you're using encryption, such as
visiting a bank or e-commerce website, or encrypted mail connections,
etc, it will only know the destination. It won't be able to see the
data inside the traffic stream. You are still protected from this node
figuring out who you are and if using encryption, what data you're
sending to the destination.
To summarize : The first relay sees your IP but not your message, while the third relay sees your message but not your IP (and this also only if the message is not encrypted via https). So, unless the authority manages to get its bogus relays used as both first and third relays, it cannot fully trace your activities. And given the enormous number of Tor relays in the world, the authority will need to set up an enormous number of relays to have a good statistical chance of having its relays randomly selected as both first and third in the Tor chain.
Tor even has a protection against this scenario as well : You can I control which nodes (or country) are used for entry/exit. Tor also uses "entry guards" : each Tor client selects a few relays at random to use as entry points, and uses only those relays as first hop.
Conclusion : Tor is quite well protected, and one can further calibrate it to make it very safe from any one particular national agency. Using https (when possible) ensures even better protection.