Why drop-www?
Because of HSTS vs double redirects, see:
no clean HSTS-Preload / DNSSEC - #10 by Patrick
drop-www vs yes-www security, considerations, references:
Dev/About Infrastructure - Kicksecure chapter drop-www vs yes-www in Kicksecure wiki
(Whonix is based on Kicksecure.)