so yes, wss is the SSL version of ws

the local address on your start9 is encrypted, so locally, using the .local works under wss

but, you start9 is not accessible outside your network in that fashion

if you want to access outside your local ( same lan subnet ) .. you have to use the .onion address, which doesn't use ssl , hence just the ws

but ... if you want to access an onion relay from your nostr client, then you need to be on the Tor Network.

for instance, on my Android, I run orbit in VPN mode, and I chose, bitwarden, amethyst and plebstr, to run through orbit, giving me access to my onion hidden services.

clear as mud right? ask me questions :)