If accompanied by the exact same sha-256 hash idea, loading from any external source cannot expose the user to any additional risk. SHA + CDN url list (for whi

If accompanied by the exact same sha-256 hash idea, loading from any external source cannot expose the user to any additional risk. SHA + CDN url list (for whitelisting/reliability purposes - public/trusted, and then private for reliability) would be ideal.