[derefr]

Mind you, most of these TLS-origin-requiring features are only accessible through Javascript APIs — and so won't be used by any "zero trust" Tor hidden services (which must assume the client's Javascript is disabled) anyway.