v5. Forgot to account for look-up failures (shocking not shocking).
Also removed hard-coded port numbers from tests.

The EWW example from earlier needs some adapting:

  ;; M-x eww RET https://check.torproject.org RET

  (require 'socks)
  (require 'gnutls)
  (require 'nsm)

  (defun my-socks-open-https (name buffer host service &rest params)
    (let ((proc (apply #'socks-open-network-stream-legacy
                       name buffer host service params)))
      (advice-add 'network-lookup-address-info :override #'socks-tor-resolve)
      (unwind-protect
          (when (eq service 443)
            (gnutls-negotiate :process proc :hostname host)
            (unless (string-suffix-p ".onion" host)
              (nsm-verify-connection proc host service)))
        (advice-remove 'network-lookup-address-info #'socks-tor-resolve))
      proc))

  (setq socks-server '("tor" "127.0.0.1" 9050 5)
        socks-username ""
        socks-password ""
        url-gateway-method 'socks
        socks-open-network-stream-function #'my-socks-open-https)

Let me know if you need help. Thanks.