True (plus no more mixed content warning) but not exactly 100% of the picture, warrants a footnote here. Unless you actually know which source you expect to ge

True (plus no more mixed content warning) but not exactly 100% of the picture, warrants a footnote here. Unless you actually know which source you expect to get from, you can't tell if https://evil.com/evil.js https://evil.com/evil.js is intended over https://legit.com/legit.js https://legit.com/legit.js. In the end, they are over https, and authenticated. From a user point of view, I am not sure how we can actually defend that, but as an author of a page, you can try to enforce expectation with various HTTP headers (CSP, suborigin integrity). Authentication is one thing, but determining the integrity is another.