The OFTC onion server is: ircs://oftcnet6xg6roj6d7id4y4cu6dchysacqj2ldgea73qzdagufflqxrid.onion:6697 That onion has some load balancing function so there are multiple different hosts that could handle the handshaking. ATM, these two fingerprints are possible: * 63:0F:19:BB:AF:61:5A:9F:B1:03:98:0A:70:4A:DA:E9:E6:C9:73:9E:1F:53:AD:DD:83:43:E4:E1:71:3A:50:B5 * 2C:12:F2:C6:1B:01:DD:99:0F:3A:BC:1D:1C:6B:75:87:CC:B8:18:97:84:F9:B5:21:2A:18:2D:18:CC:D4:96:EC depending on which non-deterministic host answers the connection. IRSSI is only capable of pinning one fingerprint. And the user has no control over which host will be selected. I tagged this as wishlist but it might actually be a severe bug. I have been unable to test further. But it’s important to realise that if you use socat to tunnel to an onion host, the hostname of “localhost” will fail a TLS check, thus forcing TLS verification to be disabled. Of course under those circumstances pubkey pinning is critically important. Being able to pin multiple keys is therefore important.