The idea is to provide protection even in HTTP-only environments (as HTTP is enforced in some places). It would add overhead to verify hashes in the manner tha

The idea is to provide protection even in HTTP-only environments (as HTTP is enforced in some places). It would add overhead to verify hashes in the manner that you have mentioned but I think it's worth it.