Yes, if you ship your app in a virtual machine you have to live by their rules :)

I could have hardcoded the relay IP instead of domain, but then it wouldn't have worked within https apps.

If you dislike this dependency on ICANN, build native apps, and or help us convince browsers to support pkarr TLDs (will take years).