code: func (l *torValidityTooLarge) CheckApplies(c *x509.Certificate) bool {
  	return util.IsSubscriberCert(c) && util.CertificateSubjInTLD(c, onionTLD)
  }
docs: // CheckApplies returns true if the certificate is a subscriber certificate that
  // contains a subject name ending in `.onion`.