Hello,
Thanks for reaching out and for your interest in privacy products such as CryptPad and Tor.
We are indeed very interested in running CryptPad as a .onion service. However, I believe the current requirement for two domain names signed by the same and unique TLS certificate makes it almost impossible.
We are thinking of ways to improve this, especially lifting the requirement for a second domain and force the use of another kind of iframe instead.