I've been thinking about this problem for Airborn OS. In my opinion, the best place to put signatures of the "main resource" would be the website's certificate.

I've been thinking about this problem for Airborn OS. In my opinion, the best place to put signatures of the "main resource" would be the website's certificate. [1] I created a Firefox extension that can check signatures both in the certificate and (in the meantime) hardcoded in the extension. [2] [1]: http://blog.airbornos.com/post/2015/04/25/Secure-Delivery-of-JavaScript http://blog.airbornos.com/post/2015/04/25/Secure-Delivery-of... [2]: http://blog.airbornos.com/post/2016/02/23/The-first-web-application-that-doesn-t-trust-the-server http://blog.airbornos.com/post/2016/02/23/The-first-web-appl...