Cross-site caching adds all the risk you intend to take away by adding the integrity attribute. What if someone makes a Jquery.js file that hash-conflicts with

Cross-site caching adds all the risk you intend to take away by adding the integrity attribute. What if someone makes a Jquery.js file that hash-conflicts with the version you have, but has a malicious payload. You visit bob.com, get the infected jquery with the hash 0xcafebabe, which just so happens to match with jquery's 0xcafebabe. You might say wow how unlikely, but with entire botnets dedicated to guessing matching hashes, something like this could be devastating.