Many of the obscure WebKit browsers do not validate certificates on subresources, which allows MitM attackers to replace third party scripts with malicious ones

Many of the obscure WebKit browsers do not validate certificates on subresources, which allows MitM attackers to replace third party scripts with malicious ones. Some of them do this without even any UI indication that there is a problem. I have a test page here: https://rya.nc/https-script.html https://rya.nc/https-script.html