Was only .bch. The daemon and CA already handle these four TLDs; the NRPT
rule was the missing piece that made .p2p / .bit / .nav queries never reach
the daemon at all (they went to ICANN's normal DNS and NXDOMAIN'd).
Dual TLDs (.de .ru .dev .ltd) intentionally NOT here. They need the
daemon's DNS-forwarding path to work reliably for unregistered names,
and there's still an open EDNS/AAAA forwarding bug in bnsd.js that
would break most German/Russian sites if we NRPT'd .de.
Adding more native TLDs (.x .sia .dgb .nt from Theseus's expanded set)
needs a CA rotation first — the current CA's nameConstraints only permit
bch/p2p/bit/deviant/nav/test/bcnr. Deferred.
- Security popover redesigned to resemble Firefox's site-info panel:
lock/shield hero, "Connection secure" status, host, plain-language
subtitle, and a details grid; the overlay view auto-sizes to content.
- Search-engine picker returned to the toolbar with an "Add / edit engines…"
entry that opens Settings; added Ecosia, Mojeek, Presearch.
- Custom search engines: add (name + URL template with %s) / remove in
Settings > General; used by address-bar search.
- Address-bar placeholder: "Ask a search engine or enter web address".
