Here's a potentially easier to read (doesn't require JavaScript) document explaining WebSign: https://www.cyph.com/websign https://www.cyph.com/websign It's a

Here's a potentially easier to read (doesn't require JavaScript) document explaining WebSign: https://www.cyph.com/websign https://www.cyph.com/websign It's a really smart idea, although it did have some odd edge cases, and required you to trust that they really were throwing away the keys as promised. There is some talk in the W3C of extending the SRI standard to let a website declare that all (or just certain) included resources have been signed by an (offline) PGP key: https://github.com/w3c/webappsec/issues/449 https://github.com/w3c/webappsec/issues/449 so we might one day reach a point where running a webapp at least has the small security guarantee that a TOFU policy gives you. If this could be combined with versioned releases of webapps, and the signature appearing in something like a Binary Transparency log, then the security guarantee could actually be quite meaningful: https://wiki.mozilla.org/Security/Binary_Transparency https://wiki.mozilla.org/Security/Binary_Transparency