I actually imagined they always would since you would use the url to verify the pubkey. Why would they build hidden services without it?

Public-key cryptography is used by Tor hidden services but it's not based on TLS/SSL certificates. There are a lot of detailed explanations of how this works on the web, but if you just want a quick overview I recently wrote about in the introduction of an article for 2600 (summer 2017 issue https://store.2600.com/collections/2010-2015/products/summer...). You can find a copy of my article here: https://pablo.rauzy.name/outreach/2600/how-to-run-a-tor-hidd...