For the main HTML document, what would prevent the ISP from simply changing the hash to include/account for the injected ad spam code?[1] (for iframes, I think

For the main HTML document, what would prevent the ISP from simply changing the hash to include/account for the injected ad spam code?[1] (for iframes, I think this would work fine) [1]: I'm presuming you're not using TLS, because if you were, then TLS would do this and more.