It will match the hostname: you visit google.com, you get google's cert, but the traffic goes over nostr (through a socks proxy).