Soso on Nostr: why though? Aren't onion addresses already authentified by the public key included in ...

why though? Aren't onion addresses already authentified by the public key included in the address? Why would the public key also need to be conveyed through a certificate?