With the DNS and Alt-Src, are you saying that the Onion site identity can be verified by visiting the non-onion version of the site, and then relying on the hea

With the DNS and Alt-Src, are you saying that the Onion site identity can be verified by visiting the non-onion version of the site, and then relying on the header/DNS record to take the session onto Tor? Then when the onion service private key is breached, the site operator just changes the header and DNS record to a new, non-breached one? As you say though, querying these does reduce anonymity.