Right, my suggestion was that you would not give them a certificate for your domain example.com, you would just give them a certificate for staticresources.exam

Right, my suggestion was that you would not give them a certificate for your domain example.com, you would just give them a certificate for staticresources.example.com, and you would never load anything from that subdomain without subresource integrity checks (or load anything whose contents or mere existence leaked important information, or...)