it doesn't say it in NIP-05 but nowhere does it have http://
but actually, there is a reason why it should be https:// only - to prevent man in the middle attacks.
Discussion
what if its an onion site
yeah, idk, i think we are diverging into implementation problems there because accessing Tor is quite involved for a client to have as a function.
i was also thinking about reverse lookup PTR records but that is a whole mess as well.
one idea my friend was talking about was putting a compact version of the npub in a TXT record, but that's a whole extra NIP to propose i think.