Web Packaging sounds really interesting. I think there's a need for another layer of security in certain types of web applications (secure messaging, financial

Web Packaging sounds really interesting. I think there's a need for another layer of security in certain types of web applications (secure messaging, financial, cryptocurrency). It sounds like this is a "nice to have" use-case: https://github.com/WICG/webpackage/blob/master/draft-yasskin-webpackage-use-cases.md#third-party-security-review-security-review https://github.com/WICG/webpackage/blob/master/draft-yasskin... I've almost been able to abuse Service Workers for this purpose. After the Service Worker is installed on first load you can intercept any requests (including the HTML and JavaScript) and verify a signature on them using a key embedded in the Service Worker. The big problem is it seems like you can't reliably prevent the browser from trying to update the Service Worker itself, which is obviously a deal breaker. Also shift-reload bypasses the Service Worker completely.